- 16 Dec, 2015 34 commits
-
-
rmcilroy authored
Adds a slot for the bytecode offset to interpreter stack frames and saves it on calls, and restores after calls. Also fixes RawMachineAssembler::Return() to call MergeControlToEnd. BUG=v8:4280 LOG=N Review URL: https://codereview.chromium.org/1512543002 Cr-Commit-Position: refs/heads/master@{#32906}
-
adamk authored
BUG=v8:811 LOG=y Review URL: https://codereview.chromium.org/1515613009 Cr-Commit-Position: refs/heads/master@{#32905}
-
bmeurer authored
R=verwaest@chromium.org Review URL: https://codereview.chromium.org/1534443002 Cr-Commit-Position: refs/heads/master@{#32904}
-
cbruni authored
We can no longer just walk the prototype chain without doing proper access-checks. When installing a proxy as the __proto__ of the global object we might accidentally end up invoking cross-realm code without access-checks (see proxies-cross-realm-ecxeption.js). Review URL: https://codereview.chromium.org/1521953002 Cr-Commit-Position: refs/heads/master@{#32903}
-
neis authored
We must print "[object Array]" for proxies that satisfy Array.isArray. Cosmetic change on the side: move ObjectProtoToString from JSObject to Object since it deals with arbitrary objects. R=adamk@chromium.org, verwaest@chromium.org BUG=v8:1543 LOG=n Review URL: https://codereview.chromium.org/1526023002 Cr-Commit-Position: refs/heads/master@{#32902}
-
bmeurer authored
Introduce JSCreateIterResultObject operator, as a way to optimize the %_CreateIterResultObject intrinsic, which is used to provide uniform, non-polymorphic result objects for iterators (and generators). We cannot utilize the existing JSCreate operator here, because there's no constructor function for iterator result objects (as required by the spec). R=mstarzinger@chromium.org Review URL: https://codereview.chromium.org/1531753002 Cr-Commit-Position: refs/heads/master@{#32901}
-
neis authored
R=rossberg BUG=v8:1543 LOG=n Review URL: https://codereview.chromium.org/1525983002 Cr-Commit-Position: refs/heads/master@{#32900}
-
mlippautz authored
Tests for * aborting a full page. * partially aborting a page. * partially aborting a page with pointers between aborted pages. * partially aborting a page with store buffer entries. Also introduces force_oom() which prohibits a old space to expand BUG=chromium:524425 LOG=N CQ_EXTRA_TRYBOTS=tryserver.v8:v8_linux_nosnap_rel,v8_linux_nosnap_dbg,v8_win_nosnap_shared_rel,v8_win_nosnap_shared_compile_rel Review URL: https://codereview.chromium.org/1518803005 Cr-Commit-Position: refs/heads/master@{#32899}
-
yangguo authored
R=erik.corry@gmail.com BUG=chromium:570241 LOG=N Review URL: https://codereview.chromium.org/1528333002 Cr-Commit-Position: refs/heads/master@{#32898}
-
yangguo authored
The problem is this: when stepping over a recursive function call, the recursive function is flooded with one-shot break points so that we break after the call, but since the callee is the same function, the callee is also flooded, resulting a break in the callee. That however would have been a "step in" instead of "step over". The original solution was to recognize this by comparing FP. If we end up in Debug::Break, we still have to check the current FP against the remembered FP to see whether we are on the same stack height. If we are deeper, then it's not a "step over", and we do not trigger a debug break event. In that case, we queue up the step-over, and temporarily step out until we hit the desired stack height. Note that in order to step out, we flood the caller, which in our example is the same function as the callee. So we break at every flooded break location, and comparing with FP to make sure we stepped out prevents us from triggering debug break events. The new solution simply ignores breaks when the FP compare fails. We simply carry on until we hit a break where the FP compare succeeds. There is no need to do a step out. The number of calls to Debug::Break that do not trigger a debug break event due to failing FP compare is the same. But the code is a lot easier to read. R=jkummerow@chromium.org Review URL: https://codereview.chromium.org/1527253002 Cr-Commit-Position: refs/heads/master@{#32897}
-
jochen authored
While not really fitting our directory layout, the DEPS entry needs to be at exactly the same position as it is in chromium, otherwise either standalone or chromium build won't work :-/ BUG=none R=machenbach@chromium.org LOG=y Review URL: https://codereview.chromium.org/1526843004 Cr-Commit-Position: refs/heads/master@{#32896}
-
aseemgarg authored
TEST=asm-wasm.js R=titzer@chromium.org,bradnelson@google.com BUG= Review URL: https://codereview.chromium.org/1523843003 Cr-Commit-Position: refs/heads/master@{#32895}
-
ahaas authored
The new implementation also changes the sign bit if the input is NaN. (https://github.com/WebAssembly/v8-native-prototype/issues/99) R=bradnelson@chromium.org Review URL: https://codereview.chromium.org/1532513002 Cr-Commit-Position: refs/heads/master@{#32894}
-
ahaas authored
The code generation for pushing call parameters on the stack does not distinguish between float32 and float64 parameters because both are stored in the same registers. Therefore float32 parameters require two words on the stack. The wasm linkage, however, only considered one word on the stack for float32 parameters, which caused the problem that float32 parameters were not located correctly on the stack. I fixed the problem by considering two words for float32 parameters on the stack. R=bradnelson@chromium.org Review URL: https://codereview.chromium.org/1529773003 Cr-Commit-Position: refs/heads/master@{#32893}
-
jkummerow authored
BUG=v8:1543,chromium:570120 LOG=n Review URL: https://codereview.chromium.org/1530873002 Cr-Commit-Position: refs/heads/master@{#32892}
-
cbruni authored
LOG=n BUG=v8:1543 Review URL: https://codereview.chromium.org/1531683002 Cr-Commit-Position: refs/heads/master@{#32891}
-
bmeurer authored
Following up on https://crrev.com/1517243002, we use the %_GetSuperConstructor consistently for all super calls now (inlining the intrinsic code in fullcodegen). R=mstarzinger@chromium.org BUG=v8:3330 LOG=n Review URL: https://codereview.chromium.org/1529113002 Cr-Commit-Position: refs/heads/master@{#32890}
-
yangguo authored
R=hablich@chromium.org BUG=v8:4545 LOG=Y Review URL: https://codereview.chromium.org/1524233003 Cr-Commit-Position: refs/heads/master@{#32889}
-
caitpotter88 authored
BUG=v8:4613 LOG=N R=adamk@chromium.org Review URL: https://codereview.chromium.org/1522693002 Cr-Commit-Position: refs/heads/master@{#32888}
-
Miran.Karic authored
Fix invalid usage of layout_descriptor() function on 32-bit arch's, which doesn't perform necessary checks. Test failure is observed only on mips32 big-endian, and on mips32 little-endian as an alignment issue, but the problem appears to be generic for all 32-bit arch's. TEST=test/mjsunit/es6/classes-subclass-builtins.js BUG= Review URL: https://codereview.chromium.org/1522203004 Cr-Commit-Position: refs/heads/master@{#32887}
-
bmeurer authored
R=hablich@chromium.org Review URL: https://codereview.chromium.org/1531653002 Cr-Commit-Position: refs/heads/master@{#32886}
-
yangguo authored
And tons of changes to debugger tests. R=bmeurer@chromium.org BUG=chromium:569835 LOG=N Review URL: https://codereview.chromium.org/1525173003 Cr-Commit-Position: refs/heads/master@{#32885}
-
yangguo authored
R=jarin@chromium.org Review URL: https://codereview.chromium.org/1529823002 Cr-Commit-Position: refs/heads/master@{#32884}
-
bmeurer authored
The TypeOfStub didn't test the undetectable bit properly if the instance was also callable, and therefore returned "object" for document.all (which is both undetectable and callable). CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel R=yangguo@chromium.org BUG=chromium:567998 LOG=n Committed: https://crrev.com/02cc310370df7e51ac4f705038820066fdfd0cdc Cr-Commit-Position: refs/heads/master@{#32852} Review URL: https://codereview.chromium.org/1527863003 Cr-Commit-Position: refs/heads/master@{#32883}
-
bmeurer authored
The %HeapObjectGetMap and %MapGetInstanceType intrinsics are obsolete because they are unsafe, so we can drop the code. R=yangguo@chromium.org Review URL: https://codereview.chromium.org/1532493002 Cr-Commit-Position: refs/heads/master@{#32882}
-
bmeurer authored
The JSCreateClosure operator always produces a function, so the type should reflect that. R=yangguo@chromium.org Review URL: https://codereview.chromium.org/1532503002 Cr-Commit-Position: refs/heads/master@{#32881}
-
bmeurer authored
If JSCreate (which corresponds to %NewObject) would ever trigger a lazy deopt, we would deopt after the constructor call, skipping all the initialization and what else in the constructor function, which is wrong. Instead we can use the eager bailout point right before the constructor function, because allocation is not observable and so we can safely repeat the %NewObject in case of lazy bailout. R=yangguo@chromium.org BUG=v8:4544 LOG=n Review URL: https://codereview.chromium.org/1530583004 Cr-Commit-Position: refs/heads/master@{#32880}
-
yangguo authored
TBR=adamk@chromium.org R=erik.corry@gmail.com BUG=v8:4616 LOG=N Review URL: https://codereview.chromium.org/1522353002 Cr-Commit-Position: refs/heads/master@{#32879}
-
bmeurer authored
Flatten ConsString objects in JSGraph, to make sure we consistently flatten all cons strings no matter which pass creates them. R=yangguo@chromium.org Review URL: https://codereview.chromium.org/1529053003 Cr-Commit-Position: refs/heads/master@{#32878}
-
yangguo authored
credits to gcov. R=cbruni@chromium.org Review URL: https://codereview.chromium.org/1522273003 Cr-Commit-Position: refs/heads/master@{#32877}
-
bmeurer authored
With the handle canonicalization we can now easily cache heap constant nodes based on the location of the HeapObject handle location. R=yangguo@chromium.org Review URL: https://codereview.chromium.org/1523323005 Cr-Commit-Position: refs/heads/master@{#32876}
-
mtrofin authored
...except for 2 places (map::insert and map::find returns) [turbofan] move down parallel moves BUG= Review URL: https://codereview.chromium.org/1531453003 Cr-Commit-Position: refs/heads/master@{#32875}
-
mtrofin authored
The regression the bug tracks (see the bug link) appears to be due to identical gap moves in the predecessors of a block not being moved to the common successor. This CR fixes one reason that is happening. BUG=chromium:549262 LOG=n Review URL: https://codereview.chromium.org/1523393003 Cr-Commit-Position: refs/heads/master@{#32874}
-
v8-autoroll authored
Rolling v8/third_party/icu to 8d342a405be5ae8aacb1e16f0bc31c3a4fbf26a2 Rolling v8/tools/clang to 6261565695263bd878edd055e81ecc5e989711d6 TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org Review URL: https://codereview.chromium.org/1529973004 Cr-Commit-Position: refs/heads/master@{#32873}
-
- 15 Dec, 2015 6 commits
-
-
jkummerow authored
The proxy may be on its own target's or handler's prototype chain, leading to infinite recursion either when looking up the trap, or when calling through to the target. We can't eagerly prevent this from happening (e.g. at "foo.__proto__ = bar" calling time) because the presence of traps can change at any time. BUG=v8:1543,chromium:569882 LOG=n Review URL: https://codereview.chromium.org/1526953002 Cr-Commit-Position: refs/heads/master@{#32872}
-
ishell authored
BUG=chromium:514080,chromium:527994,v8:4325 LOG=N Review URL: https://codereview.chromium.org/1522413002 Cr-Commit-Position: refs/heads/master@{#32871}
-
mstarzinger authored
TBR=rmcilroy@chromium.org Review URL: https://codereview.chromium.org/1526983002 Cr-Commit-Position: refs/heads/master@{#32870}
-
baptiste.afsa authored
Original CL: https://codereview.chromium.org/1375253002/ Implement machine instruction scheduling after instruction selection. R=jarin@chromium.org Review URL: https://codereview.chromium.org/1526913003 Cr-Commit-Position: refs/heads/master@{#32869}
-
yangguo authored
credits to gcov. Review URL: https://codereview.chromium.org/1528843002 Cr-Commit-Position: refs/heads/master@{#32868}
-
mstarzinger authored
This fixes a path in the compilation pipeline that side-stepped the interpreter when a function literal was eagerly compiled. This caused the interpreter to miss some test coverage. R=rmcilroy@chromium.org Review URL: https://codereview.chromium.org/1528853002 Cr-Commit-Position: refs/heads/master@{#32867}
-