libv8 6.0.286.44.0beta1 → 6.0.286.54.0beta1

data/vendor/v8/include/v8-version.h

@@ -11,7 +11,7 @@
 #define V8_MAJOR_VERSION 6
 #define V8_MINOR_VERSION 0
 #define V8_BUILD_NUMBER 286
-#define V8_PATCH_LEVEL 44
+#define V8_PATCH_LEVEL 54
 
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)

data/vendor/v8/src/builtins/builtins-array-gen.cc

@@ -117,6 +117,7 @@ class ArrayBuiltinCodeStubAssembler : public CodeStubAssembler {
 
       BIND(&fast);
       {
+        GotoIf(SmiNotEqual(LoadJSArrayLength(a()), to_.value()), &runtime);
         kind = EnsureArrayPushable(a(), &runtime);
         GotoIf(IsElementsKindGreaterThan(kind, FAST_HOLEY_SMI_ELEMENTS),
                &object_push_pre);

data/vendor/v8/src/compiler/escape-analysis.cc

@@ -438,19 +438,16 @@ bool VirtualObject::MergeFields(size_t i, Node* at, MergeCache* cache,
   int value_input_count = static_cast<int>(cache->fields().size());
   Node* rep = GetField(i);
   if (!rep || !IsCreatedPhi(i)) {
-    Type* phi_type = Type::None();
     for (Node* input : cache->fields()) {
       CHECK_NOT_NULL(input);
       CHECK(!input->IsDead());
-      Type* input_type = NodeProperties::GetType(input);
-      phi_type = Type::Union(phi_type, input_type, graph->zone());
     }
     Node* control = NodeProperties::GetControlInput(at);
     cache->fields().push_back(control);
     Node* phi = graph->NewNode(
         common->Phi(MachineRepresentation::kTagged, value_input_count),
         value_input_count + 1, &cache->fields().front());
-    NodeProperties::SetType(phi, phi_type);
+    NodeProperties::SetType(phi, Type::Any());
     SetField(i, phi, true);
 
 #ifdef DEBUG

data/vendor/v8/src/compiler/load-elimination.cc

@@ -142,7 +142,7 @@ bool IsCompatibleCheck(Node const* a, Node const* b) {
 
 Node* LoadElimination::AbstractChecks::Lookup(Node* node) const {
   for (Node* const check : nodes_) {
-    if (check && IsCompatibleCheck(check, node)) {
+    if (check && !check->IsDead() && IsCompatibleCheck(check, node)) {
       return check;
     }
   }

data/vendor/v8/src/d8.cc

@@ -135,6 +135,7 @@ class ShellArrayBufferAllocator : public ArrayBufferAllocatorBase {
     return malloc(length);
 #endif
   }
+  using ArrayBufferAllocatorBase::Free;
   void Free(void* data, size_t length) override {
 #if USE_VM
     if (RoundToPageSize(&length)) {

data/vendor/v8/src/map-updater.cc

@@ -123,6 +123,9 @@ Handle<Map> MapUpdater::ReconfigureToDataField(int descriptor,
     new_field_type_ = field_type;
   }
 
+  GeneralizeIfTransitionableFastElementsKind(
+      &new_constness_, &new_representation_, &new_field_type_);
+
   if (TryRecofigureToDataFieldInplace() == kEnd) return result_map_;
   if (FindRootMap() == kEnd) return result_map_;
   if (FindTargetMap() == kEnd) return result_map_;
@@ -134,6 +137,8 @@ Handle<Map> MapUpdater::ReconfigureToDataField(int descriptor,
 Handle<Map> MapUpdater::ReconfigureElementsKind(ElementsKind elements_kind) {
   DCHECK_EQ(kInitialized, state_);
   new_elements_kind_ = elements_kind;
+  is_transitionable_fast_elements_kind_ =
+      IsTransitionableFastElementsKind(new_elements_kind_);
 
   if (FindRootMap() == kEnd) return result_map_;
   if (FindTargetMap() == kEnd) return result_map_;
@@ -153,6 +158,28 @@ Handle<Map> MapUpdater::Update() {
   return result_map_;
 }
 
+void MapUpdater::GeneralizeIfTransitionableFastElementsKind(
+    PropertyConstness* constness, Representation* representation,
+    Handle<FieldType>* field_type) {
+  DCHECK_EQ(is_transitionable_fast_elements_kind_,
+            IsTransitionableFastElementsKind(new_elements_kind_));
+  if (is_transitionable_fast_elements_kind_ &&
+      Map::IsInplaceGeneralizableField(*constness, *representation,
+                                       **field_type)) {
+    // We don't support propagation of field generalization through elements
+    // kind transitions because they are inserted into the transition tree
+    // before field transitions. In order to avoid complexity of handling
+    // such a case we ensure that all maps with transitionable elements kinds
+    // do not have fields that can be generalized in-place (without creation
+    // of a new map).
+    if (FLAG_track_constant_fields && FLAG_modify_map_inplace) {
+      *constness = kMutable;
+    }
+    DCHECK(representation->IsHeapObject());
+    *field_type = FieldType::Any(isolate_);
+  }
+}
+
 void MapUpdater::GeneralizeField(Handle<Map> map, int modify_index,
                                  PropertyConstness new_constness,
                                  Representation new_representation,
@@ -489,6 +516,9 @@ Handle<DescriptorArray> MapUpdater::BuildDescriptorArray() {
           old_details.representation(), old_field_type, next_representation,
           target_field_type, isolate_);
 
+      GeneralizeIfTransitionableFastElementsKind(
+          &next_constness, &next_representation, &next_field_type);
+
       Handle<Object> wrapped_type(Map::WrapFieldType(next_field_type));
       Descriptor d;
       if (next_kind == kData) {
@@ -532,10 +562,17 @@ Handle<DescriptorArray> MapUpdater::BuildDescriptorArray() {
 
     Descriptor d;
     if (next_location == kField) {
-      Handle<FieldType> old_field_type =
+      Handle<FieldType> next_field_type =
           GetOrComputeFieldType(i, old_details.location(), next_representation);
 
-      Handle<Object> wrapped_type(Map::WrapFieldType(old_field_type));
+      // If the |new_elements_kind_| is still transitionable then the old map's
+      // elements kind is also transitionable and therefore the old descriptors
+      // array must already have non in-place generalizable fields.
+      CHECK_IMPLIES(is_transitionable_fast_elements_kind_,
+                    !Map::IsInplaceGeneralizableField(
+                        next_constness, next_representation, *next_field_type));
+
+      Handle<Object> wrapped_type(Map::WrapFieldType(next_field_type));
       Descriptor d;
       if (next_kind == kData) {
         DCHECK_IMPLIES(!FLAG_track_constant_fields, next_constness == kMutable);

data/vendor/v8/src/map-updater.h

@@ -49,7 +49,9 @@ class MapUpdater {
         old_map_(old_map),
         old_descriptors_(old_map->instance_descriptors(), isolate_),
         old_nof_(old_map_->NumberOfOwnDescriptors()),
-        new_elements_kind_(old_map_->elements_kind()) {
+        new_elements_kind_(old_map_->elements_kind()),
+        is_transitionable_fast_elements_kind_(
+            IsTransitionableFastElementsKind(new_elements_kind_)) {
     // We shouldn't try to update remote objects.
     DCHECK(!old_map->FindRootMap()->GetConstructor()->IsFunctionTemplateInfo());
   }
@@ -146,6 +148,10 @@ class MapUpdater {
       Handle<DescriptorArray> descriptors, int descriptor,
       PropertyLocation location, Representation representation);
 
+  inline void GeneralizeIfTransitionableFastElementsKind(
+      PropertyConstness* constness, Representation* representation,
+      Handle<FieldType>* field_type);
+
   void GeneralizeField(Handle<Map> map, int modify_index,
                        PropertyConstness new_constness,
                        Representation new_representation,
@@ -161,8 +167,9 @@ class MapUpdater {
 
   State state_ = kInitialized;
   ElementsKind new_elements_kind_;
+  bool is_transitionable_fast_elements_kind_;
 
-  // If |modified_descriptor_| is not equal to -1 them the fields below form
+  // If |modified_descriptor_| is not equal to -1 then the fields below form
   // an "update" of the |old_map_|'s descriptors.
   int modified_descriptor_ = -1;
   PropertyKind new_kind_ = kData;

data/vendor/v8/src/objects-debug.cc

@@ -349,11 +349,14 @@ void JSObject::JSObjectVerify() {
     }
     DescriptorArray* descriptors = map()->instance_descriptors();
     Isolate* isolate = GetIsolate();
+    bool is_transitionable_fast_elements_kind =
+        IsTransitionableFastElementsKind(map()->elements_kind());
+
     for (int i = 0; i < map()->NumberOfOwnDescriptors(); i++) {
       PropertyDetails details = descriptors->GetDetails(i);
       if (details.location() == kField) {
         DCHECK_EQ(kData, details.kind());
-        Representation r = descriptors->GetDetails(i).representation();
+        Representation r = details.representation();
         FieldIndex index = FieldIndex::ForDescriptor(map(), i);
         if (IsUnboxedDoubleField(index)) {
           DCHECK(r.IsDouble());
@@ -376,6 +379,9 @@ void JSObject::JSObjectVerify() {
           CHECK(!field_type->NowStable() || field_type->NowContains(value) ||
                 (!FLAG_use_allocation_folding && value->IsUndefined(isolate)));
         }
+        CHECK_IMPLIES(is_transitionable_fast_elements_kind,
+                      !Map::IsInplaceGeneralizableField(details.constness(), r,
+                                                        field_type));
       }
     }
   }

data/vendor/v8/src/objects.cc

@@ -3289,6 +3289,16 @@ MaybeHandle<Map> Map::CopyWithField(Handle<Map> map, Handle<Name> name,
   if (map->instance_type() == JS_CONTEXT_EXTENSION_OBJECT_TYPE) {
     representation = Representation::Tagged();
     type = FieldType::Any(isolate);
+  } else if (IsTransitionableFastElementsKind(map->elements_kind()) &&
+             IsInplaceGeneralizableField(constness, representation, *type)) {
+    // We don't support propagation of field generalization through elements
+    // kind transitions because they are inserted into the transition tree
+    // before field transitions. In order to avoid complexity of handling
+    // such a case we ensure that all maps with transitionable elements kinds
+    // do not have fields that can be generalized in-place (without creation
+    // of a new map).
+    DCHECK(representation.IsHeapObject());
+    type = FieldType::Any(isolate);
   }
 
   Handle<Object> wrapped_type(WrapFieldType(type));
@@ -3935,7 +3945,6 @@ Handle<Map> Map::CopyGeneralizeAllFields(Handle<Map> map,
   return new_map;
 }
 
-
 void Map::DeprecateTransitionTree() {
   if (is_deprecated()) return;
   Object* transitions = raw_transitions();
@@ -4078,7 +4087,6 @@ Handle<FieldType> Map::GeneralizeFieldType(Representation rep1,
   return FieldType::Any(isolate);
 }
 
-
 // static
 void Map::GeneralizeField(Handle<Map> map, int modify_index,
                           PropertyConstness new_constness,
@@ -4112,8 +4120,8 @@ void Map::GeneralizeField(Handle<Map> map, int modify_index,
 
   // Determine the field owner.
   Handle<Map> field_owner(map->FindFieldOwner(modify_index), isolate);
-  Handle<DescriptorArray> descriptors(
-      field_owner->instance_descriptors(), isolate);
+  Handle<DescriptorArray> descriptors(field_owner->instance_descriptors(),
+                                      isolate);
   DCHECK_EQ(*old_field_type, descriptors->GetFieldType(modify_index));
 
   new_field_type =
@@ -4860,7 +4868,7 @@ Map* Map::FindElementsKindTransitionedMap(MapHandles const& candidates) {
   if (IsTransitionableFastElementsKind(kind)) {
     // Check the state of the root map.
     Map* root_map = FindRootMap();
-    if (!EquivalentToForTransition(root_map)) return nullptr;
+    if (!EquivalentToForElementsKindTransition(root_map)) return nullptr;
     root_map = root_map->LookupElementsTransitionMap(kind);
     DCHECK_NOT_NULL(root_map);
     // Starting from the next existing elements kind transition try to
@@ -12048,7 +12056,7 @@ bool Map::EquivalentToForTransition(Map* other) {
   if (!CheckEquivalent(this, other)) return false;
   if (instance_type() == JS_FUNCTION_TYPE) {
     // JSFunctions require more checks to ensure that sloppy function is
-    // not equvalent to strict function.
+    // not equivalent to strict function.
     int nof = Min(NumberOfOwnDescriptors(), other->NumberOfOwnDescriptors());
     return instance_descriptors()->IsEqualUpTo(other->instance_descriptors(),
                                                nof);
@@ -12056,6 +12064,25 @@ bool Map::EquivalentToForTransition(Map* other) {
   return true;
 }
 
+bool Map::EquivalentToForElementsKindTransition(Map* other) {
+  if (!EquivalentToForTransition(other)) return false;
+#ifdef DEBUG
+  // Ensure that we don't try to generate elements kind transitions from maps
+  // with fields that may be generalized in-place. This must already be handled
+  // during addition of a new field.
+  DescriptorArray* descriptors = instance_descriptors();
+  int nof = NumberOfOwnDescriptors();
+  for (int i = 0; i < nof; i++) {
+    PropertyDetails details = descriptors->GetDetails(i);
+    if (details.location() == kField) {
+      DCHECK(!IsInplaceGeneralizableField(details.constness(),
+                                          details.representation(),
+                                          descriptors->GetFieldType(i)));
+    }
+  }
+#endif
+  return true;
+}
 
 bool Map::EquivalentToForNormalization(Map* other,
                                        PropertyNormalizationMode mode) {

data/vendor/v8/src/objects.h

@@ -249,7 +249,6 @@ enum SimpleTransitionFlag {
   SPECIAL_TRANSITION
 };
 
-
 // Indicates whether we are only interested in the descriptors of a particular
 // map, or in all descriptors in the descriptor array.
 enum DescriptorFlag {

data/vendor/v8/src/objects/map-inl.h

@@ -5,6 +5,7 @@
 #ifndef V8_OBJECTS_MAP_INL_H_
 #define V8_OBJECTS_MAP_INL_H_
 
+#include "src/field-type.h"
 #include "src/objects/map.h"
 
 // Has to be the last include (doesn't have include guards):
@@ -27,6 +28,20 @@ InterceptorInfo* Map::GetIndexedInterceptor() {
   return InterceptorInfo::cast(info->indexed_property_handler());
 }
 
+bool Map::IsInplaceGeneralizableField(PropertyConstness constness,
+                                      Representation representation,
+                                      FieldType* field_type) {
+  if (FLAG_track_constant_fields && FLAG_modify_map_inplace &&
+      (constness == kConst)) {
+    // kConst -> kMutable field generalization may happen in-place.
+    return true;
+  }
+  if (representation.IsHeapObject() && !field_type->IsAny()) {
+    return true;
+  }
+  return false;
+}
+
 int NormalizedMapCache::GetIndex(Handle<Map> map) {
   return map->Hash() % NormalizedMapCache::kEntries;
 }

data/vendor/v8/src/objects/map.h

@@ -290,6 +290,11 @@ class Map : public HeapObject {
                               PropertyConstness new_constness,
                               Representation new_representation,
                               Handle<FieldType> new_field_type);
+  // Returns true if |descriptor|'th property is a field that may be generalized
+  // by just updating current map.
+  static inline bool IsInplaceGeneralizableField(PropertyConstness constness,
+                                                 Representation representation,
+                                                 FieldType* field_type);
 
   static Handle<Map> ReconfigureProperty(Handle<Map> map, int modify_index,
                                          PropertyKind new_kind,
@@ -719,6 +724,7 @@ class Map : public HeapObject {
                                 Handle<Name> name, SimpleTransitionFlag flag);
 
   bool EquivalentToForTransition(Map* other);
+  bool EquivalentToForElementsKindTransition(Map* other);
   static Handle<Map> RawCopy(Handle<Map> map, int instance_size);
   static Handle<Map> ShareDescriptor(Handle<Map> map,
                                      Handle<DescriptorArray> descriptors,

data/vendor/v8/src/v8.gyp

@@ -1904,6 +1904,13 @@
           # limit. This breaks it into multiple pieces to avoid the limit.
           # See http://crbug.com/485155.
           'msvs_shard': 4,
+          # This will prevent V8's .cc files conflicting with the inspector's
+          # .cpp files in the same shard.
+          'msvs_settings': {
+            'VCCLCompilerTool': {
+              'ObjectFile':'$(IntDir)%(Extension)\\',
+            },
+          },
         }],
         ['component=="shared_library"', {
           'defines': [

data/vendor/v8/src/wasm/wasm-module.cc

@@ -2775,16 +2775,16 @@ class AsyncCompileJob {
 
   // A closure to run a compilation step (either as foreground or background
   // task) and schedule the next step(s), if any.
-  template <TaskType task_type>
   class CompileTask : NON_EXPORTED_BASE(public v8::Task) {
    public:
-    constexpr static TaskType type = task_type;
     AsyncCompileJob* job_ = nullptr;
     CompileTask() {}
     void Run() override = 0;  // Force sub-classes to override Run().
   };
 
-  class SyncCompileTask : public CompileTask<SYNC> {
+  class AsyncCompileTask : public CompileTask {};
+
+  class SyncCompileTask : public CompileTask {
    public:
     void Run() final {
       SaveContext saved_context(job_->isolate_);
@@ -2798,7 +2798,8 @@ class AsyncCompileJob {
 
   template <typename Task, typename... Args>
   void DoSync(Args&&... args) {
-    static_assert(Task::type == SYNC, "Scheduled type must be sync");
+    static_assert(std::is_base_of<SyncCompileTask, Task>::value,
+                  "Scheduled type must be sync");
     Task* task = new Task(std::forward<Args>(args)...);
     task->job_ = this;
     V8::GetCurrentPlatform()->CallOnForegroundThread(
@@ -2807,7 +2808,8 @@ class AsyncCompileJob {
 
   template <typename Task, typename... Args>
   void DoAsync(Args&&... args) {
-    static_assert(Task::type == ASYNC, "Scheduled type must be async");
+    static_assert(std::is_base_of<AsyncCompileTask, Task>::value,
+                  "Scheduled type must be async");
     Task* task = new Task(std::forward<Args>(args)...);
     task->job_ = this;
     V8::GetCurrentPlatform()->CallOnBackgroundThread(
@@ -2817,7 +2819,7 @@ class AsyncCompileJob {
   //==========================================================================
   // Step 1: (async) Decode the module.
   //==========================================================================
-  class DecodeModule : public CompileTask<ASYNC> {
+  class DecodeModule : public AsyncCompileTask {
     void Run() override {
       ModuleResult result;
       {
@@ -2958,7 +2960,7 @@ class AsyncCompileJob {
   //==========================================================================
   // Step 3 (async x K tasks): Execute compilation units.
   //==========================================================================
-  class ExecuteCompilationUnits : public CompileTask<ASYNC> {
+  class ExecuteCompilationUnits : public AsyncCompileTask {
     void Run() override {
       TRACE_COMPILE("(3) Compiling...\n");
       for (;;) {
@@ -3011,7 +3013,7 @@ class AsyncCompileJob {
   //==========================================================================
   // Step 4b (async): Wait for all background tasks to finish.
   //==========================================================================
-  class WaitForBackgroundTasks : public CompileTask<ASYNC> {
+  class WaitForBackgroundTasks : public AsyncCompileTask {
    public:
     explicit WaitForBackgroundTasks(ErrorThrower thrower)
         : thrower_(std::move(thrower)) {}

data/vendor/v8/tools/run-tests.py

@@ -787,7 +787,7 @@ def Execute(arch, mode, args, options, suites):
   simulator_run = not options.dont_skip_simulator_slow_tests and \
       arch in ['arm64', 'arm', 'mipsel', 'mips', 'mips64', 'mips64el', \
                'ppc', 'ppc64', 's390', 's390x'] and \
-      ARCH_GUESS and arch != ARCH_GUESS
+      bool(ARCH_GUESS) and arch != ARCH_GUESS
   # Find available test suites and read test cases from them.
   variables = {
     "arch": arch,

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: libv8
 version: !ruby/object:Gem::Version
-  version: 6.0.286.44.0beta1
+  version: 6.0.286.54.0beta1
 platform: ruby
 authors:
 - Charles Lowell
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-07-27 00:00:00.000000000 Z
+date: 2017-08-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -417,6 +417,7 @@ files:
 - vendor/depot_tools/recipes/recipe_modules/bot_update/__init__.py
 - vendor/depot_tools/recipes/recipe_modules/bot_update/api.py
 - vendor/depot_tools/recipes/recipe_modules/bot_update/examples/full.expected/apply_gerrit_ref.json
+- vendor/depot_tools/recipes/recipe_modules/bot_update/examples/full.expected/apply_gerrit_ref_custom.json
 - vendor/depot_tools/recipes/recipe_modules/bot_update/examples/full.expected/basic.json
 - vendor/depot_tools/recipes/recipe_modules/bot_update/examples/full.expected/basic_with_branch_heads.json
 - vendor/depot_tools/recipes/recipe_modules/bot_update/examples/full.expected/buildbot.json
@@ -432,6 +433,7 @@ files:
 - vendor/depot_tools/recipes/recipe_modules/bot_update/examples/full.expected/trychange_oauth2_json.json
 - vendor/depot_tools/recipes/recipe_modules/bot_update/examples/full.expected/trychange_oauth2_json_win.json
 - vendor/depot_tools/recipes/recipe_modules/bot_update/examples/full.expected/tryjob.json
+- vendor/depot_tools/recipes/recipe_modules/bot_update/examples/full.expected/tryjob_empty_revision.json
 - vendor/depot_tools/recipes/recipe_modules/bot_update/examples/full.expected/tryjob_fail.json
 - vendor/depot_tools/recipes/recipe_modules/bot_update/examples/full.expected/tryjob_fail_patch.json
 - vendor/depot_tools/recipes/recipe_modules/bot_update/examples/full.expected/tryjob_fail_patch_download.json
@@ -572,6 +574,8 @@ files:
 - vendor/depot_tools/recipes/recipe_modules/tryserver/examples/full.expected/with_wrong_patch_new.json
 - vendor/depot_tools/recipes/recipe_modules/tryserver/examples/full.py
 - vendor/depot_tools/recipes/recipes.py
+- vendor/depot_tools/recipes/recipes/fetch_end_to_end_test.expected/basic.json
+- vendor/depot_tools/recipes/recipes/fetch_end_to_end_test.py
 - vendor/depot_tools/repo
 - vendor/depot_tools/rietveld.py
 - vendor/depot_tools/roll-dep
@@ -982,9 +986,6 @@ files:
 - vendor/depot_tools/vpython.bat
 - vendor/depot_tools/watchlists.py
 - vendor/depot_tools/weekly
-- vendor/depot_tools/win_toolchain/7z/7z.dll
-- vendor/depot_tools/win_toolchain/7z/7z.exe
-- vendor/depot_tools/win_toolchain/7z/LICENSE
 - vendor/depot_tools/win_toolchain/OWNERS
 - vendor/depot_tools/win_toolchain/README.md
 - vendor/depot_tools/win_toolchain/get_toolchain_if_necessary.py