- 07 May, 2018 1 commit
-
-
Peter Marshall authored
Bug: chromium:840106 Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng Change-Id: I0090cdecaf9194f3ed2d716c6f5f698e33cbdf0d Reviewed-on: https://chromium-review.googlesource.com/1046827 Commit-Queue: Peter Marshall <petermarshall@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#53029}
-
- 06 Feb, 2018 1 commit
-
-
Peter Marshall authored
This is the last piece of the TypedArray constructors that was still written in JS. Bug: v8:7102 Change-Id: I7c4dc867b09408caa4eec2873ea7185b6c61a525 Reviewed-on: https://chromium-review.googlesource.com/888751 Commit-Queue: Peter Marshall <petermarshall@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Sathya Gunasekaran <gsathya@chromium.org> Cr-Commit-Position: refs/heads/master@{#51122}
-
- 19 Jan, 2018 1 commit
-
-
Peter Marshall authored
This is a reland of a7c91c77. Original change's description: > [typedarray] Port ConstructByTypedArray to CSA. > > This is needed to easily port the constructor dispatcher to CSA. > > Bug: v8:7102 > Change-Id: I9672416495940ca12088a2980a9ecc61364aef9d > Reviewed-on: https://chromium-review.googlesource.com/785630 > Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Commit-Queue: Peter Marshall <petermarshall@chromium.org> > Cr-Commit-Position: refs/heads/master@{#50671} Bug: v8:7102 Change-Id: I9d839343d9b95f288f806953455c2c26ca8cab06 Reviewed-on: https://chromium-review.googlesource.com/875031Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Commit-Queue: Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#50723}
-
- 18 Jan, 2018 2 commits
-
-
Michael Achenbach authored
This reverts commit a7c91c77. Reason for revert: changes a layout test https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/21031 Original change's description: > [typedarray] Port ConstructByTypedArray to CSA. > > This is needed to easily port the constructor dispatcher to CSA. > > Bug: v8:7102 > Change-Id: I9672416495940ca12088a2980a9ecc61364aef9d > Reviewed-on: https://chromium-review.googlesource.com/785630 > Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Commit-Queue: Peter Marshall <petermarshall@chromium.org> > Cr-Commit-Position: refs/heads/master@{#50671} TBR=petermarshall@chromium.org,bmeurer@chromium.org,verwaest@chromium.org Change-Id: I118a1cb0d873a1d2e159619e5f327f9f6f7974c4 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:7102 Reviewed-on: https://chromium-review.googlesource.com/873790Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/master@{#50686}
-
Peter Marshall authored
This is needed to easily port the constructor dispatcher to CSA. Bug: v8:7102 Change-Id: I9672416495940ca12088a2980a9ecc61364aef9d Reviewed-on: https://chromium-review.googlesource.com/785630Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Commit-Queue: Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#50671}
-
- 13 Jul, 2017 1 commit
-
-
Peter Marshall authored
Previously we enforced that all lengths for ArrayLike objects must be within Smi range, but all negative numbers should actually be first converted to +0. Bug: chromium:740372 Change-Id: If50de9ce0eeb7cb09e14b8e8803f434350d00508 Reviewed-on: https://chromium-review.googlesource.com/566867Reviewed-by:
Camillo Bruni <cbruni@chromium.org> Commit-Queue: Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#46615}
-
- 26 Apr, 2017 1 commit
-
-
Peter Marshall authored
For holey Smi and double source arrays, we would go to the general case, which is much slower than before. We already check that there are no prototype chain changes in IterableToListCanBeElided, and there is no JS-code run between that check and the copying of the elements, so we can safely check for the hole and convert it to undefined, which is then converted to 0/NaN appropriately for the given TypedArray. Bug: chromium:713570,chromium:711275 Change-Id: I5b21c915907d71eebb73b7b1eea8eb58b4a5436d Reviewed-on: https://chromium-review.googlesource.com/485520 Commit-Queue: Peter Marshall <petermarshall@chromium.org> Reviewed-by:
Camillo Bruni <cbruni@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#44899}
-
- 19 Apr, 2017 1 commit
-
-
Peter Marshall authored
This includes a fastpath in the ElementsAccessor for the source array being a JSArray with FastSmi or FastDouble packed kinds. This is probably a pretty common usage, where an array is passed in as a way of initializing the TypedArray at creation (as there is not other syntax to do this). e.g. new Float64Array([1.0, 1.0, 1.0]) for some sort of vector application. BUG= v8:5977 Change-Id: Ice4ad9fc29f56b1c4b0b30736a1330efdc289003 Reviewed-on: https://chromium-review.googlesource.com/465126Reviewed-by:
Camillo Bruni <cbruni@chromium.org> Commit-Queue: Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#44722}
-
- 10 Apr, 2017 1 commit
-
-
Peter Marshall authored
The spec requires that we use IterableToList, which we skipped for some arrays as an optimization. We can't skip this for arrays with objects though, because the objects may mutate the array during the copying step via valueOf side effects. Also clean up the implementation to use a runtime function rather than a builtin as the helper. Also reverses the result of the helper because I think it is a bit more intuitive that way. Bug: v8:6224 Change-Id: I9199491abede4479785df6d9068331bc2d6e9c5e Reviewed-on: https://chromium-review.googlesource.com/471986Reviewed-by:
Camillo Bruni <cbruni@chromium.org> Commit-Queue: Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#44507}
-
- 31 Mar, 2017 1 commit
-
-
Peter Marshall authored
The last CL https://chromium-review.googlesource.com/c/456707/ caused some pretty heavy performance regressions. After experimenting, it seems the easiest and most straight-forward way to copy the elements into the new typed array is to do it in JS. Adds a fast path for typed arrays, where the source typed array has the same elements kind, in which case we can just copy the backing store using memcpy. This CL also removes regression test 319120 which is from a pwn2own vulnerability. The old code path enforced a maximum byte_length that was too low, which this change removes. The length property of the typed array must be a Smi, but the byte_length, which can be up to 8x larger than length for a Float64Array, can be a heap number. We can also re-use some of the logic from ConstructByLength when deciding whether to allocate the buffer on- or off-heap, so that is factored out into InitializeBasedOnLength. We can also re-use the DoInitialize helper instead of calling into the runtime, meaning we can remove InitializeFromArrayLike. BUG=v8:5977,chromium:705503,chromium:705394 Change-Id: I63372652091d4bdf3a9491acef9b4e3ac793a755 Reviewed-on: https://chromium-review.googlesource.com/459621Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#44301}
-
- 24 Mar, 2017 1 commit
-
-
Peter Marshall authored
This helper is used directly when constructing from an object with a length, as well as by ConstructByIterable and ByTypedArray. BUG=v8:5977 Change-Id: I18a4829c2a22a6099cf3b0824ea1f698bfbf1917 Reviewed-on: https://chromium-review.googlesource.com/456707Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Reviewed-by:
Franziska Hinkelmann <franzih@chromium.org> Commit-Queue: Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#44116}
-