- 27 Feb, 2018 22 commits
-
-
Michael Starzinger authored
R=cbruni@chromium.org BUG=v8:7438 Change-Id: I2359ff08f0c37c683bbcb164eb3120539d2bb124 Reviewed-on: https://chromium-review.googlesource.com/939468Reviewed-by:
Camillo Bruni <cbruni@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#51605}
-
Clemens Hammacher authored
When generating a 64bit memory operation on ia32, we need to emit two operations, one at {offset+4}, one at {offset}. The computation {offset+4} can overflow, which is ok because 1) it won't be used for code generation later, and 2) the generated code will not be reached because the memory access is always out of bounds anyway. R=ahaas@chromium.org Bug: v8:7499, v8:6600 Change-Id: Ia4660688c3291700c48efc201d15fc370b4dd854 Reviewed-on: https://chromium-review.googlesource.com/939389Reviewed-by:Andreas Haas <ahaas@chromium.org> Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#51604}
-
Camillo Bruni authored
The number of arguments passed on the stack might exceed the regular object size limits. Hence we need to emit write barriers when copying the arguments from the stack into the allocated array. Bug: chromium:813450 Change-Id: I829c5c32b1a7b5f4ddb01cc6ea92f85ab47126aa Reviewed-on: https://chromium-review.googlesource.com/939174Reviewed-by:
Igor Sheludko <ishell@chromium.org> Commit-Queue: Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/master@{#51603}
-
Mike Stanton authored
This is a reland of 800daded. Original change's description: > [turbofan] Masking/poisoning in codegen (optimized code, arm64) > > This introduces masking of loads with speculation bit during code generation. > At the moment, this is done only under the > --branch-load-poisoning flag, and this CL enlarges the set of supported > platforms from {x64, arm} to {x64, arm, arm64}. > > Overview of changes: > - new register configuration configuration with one register reserved for > the speculation poison/mask (kSpeculationPoisonRegister). > - in codegen, we introduce an update to the poison register at the starts > of all successors of branches (and deopts) that are marked as safety > branches (deopts). > - in memory optimizer, we lower all field and element loads to PoisonedLoads. > - poisoned loads are then masked in codegen with the poison register. > * only integer loads are masked at the moment. > > Bug: chromium:798964 > Change-Id: Ie6bc9c3bdac9998b0ef81f050a9c844399ca3ae4 > Reviewed-on: https://chromium-review.googlesource.com/928724 > Commit-Queue: Michael Stanton <mvstanton@chromium.org> > Reviewed-by: Martyn Capewell <martyn.capewell@arm.com> > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> > Cr-Commit-Position: refs/heads/master@{#51576} Bug: chromium:798964 Change-Id: I6c87d34c4e05fca0bd7f5447555133ecb0fb7a2e Reviewed-on: https://chromium-review.googlesource.com/939402Reviewed-by:
Martyn Capewell <martyn.capewell@arm.com> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Michael Stanton <mvstanton@chromium.org> Cr-Commit-Position: refs/heads/master@{#51602}
-
Clemens Hammacher authored
This adds support for f32.neg and f64.neg. Note that this cannot be computed as "0 - src", as this would not turn 0 into -0. Instead, we need to explicitly flip the sign bit. R=ahaas@chromium.org Bug: v8:6600 Change-Id: I3cbcfa156c5d2a727e0e2da279369bf055f0d657 Reviewed-on: https://chromium-review.googlesource.com/937202Reviewed-by:
-
Tobias Tebbi authored
Bug: chromium:814084 Change-Id: Ic23091e1cd778b09406c2bcde1a718e464655729 Reviewed-on: https://chromium-review.googlesource.com/939386Reviewed-by:
-
Peter Marshall authored
This will fire if the CAST is never useful. This is helpful if you add a TNode return type to a function - its callers no longer need to cast the result if the types are the same. Change-Id: If0b04c615cb2dbfa91ba43d5d0d35ace5a31d4e7 Reviewed-on: https://chromium-review.googlesource.com/934449Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#51599}
-
Jaroslav Sevcik authored
Turbofan can only handle 64K control inputs for merges. Such large can only be created by functions with 64K jumps, so we limit the bytecode size to the minimum size of bytecode arrays with 64K jumps. Bug: chromium:815392, v8:7438 Change-Id: I674705e87e19ce451b40d5827c9fe3e6ec17293a Reviewed-on: https://chromium-review.googlesource.com/938421 Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#51598}
-
Clemens Hammacher authored
Several cleanups: - unify identical macro defintions - use existing macros instead of duplicating the code - add AVX versions for xorps and xorpd (to be used by Liftoff) R=mstarzinger@chromium.org Bug: v8:7310, v8:6600 Change-Id: Id37c58cf6187533ad9d4a0ca8bc5d49f9de66785 Reviewed-on: https://chromium-review.googlesource.com/937124Reviewed-by:
-
Clemens Hammacher authored
This reverts commit 25427203. Reason for revert: code-coverage failures on gc-stress bot: https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/17956 Original change's description: > Reland: [Compiler] Use CompilationCache for StreamedScript compilation. > > Previously GetSharedFunctionInfoForStreamedScript didn't either check the > compilation cache or put the result of compilation into the compilation > cache. This would mean future compiles would need to re-parse / compile > the same script even if the isolate had already seen it. This CL > fixes this. > > Also refactors the compilation pipelines to ensure we call debug->OnAfterCompile() > for all script compiles even when loading from a cache. > > BUG=v8:5203 > Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng > > Change-Id: I0a74c5b67bfaca5e50511d5f72da0ab53d8457f6 > Reviewed-on: https://chromium-review.googlesource.com/937724 > Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> > Reviewed-by: Mythri Alle <mythria@chromium.org> > Cr-Commit-Position: refs/heads/master@{#51594} TBR=rmcilroy@chromium.org,yangguo@chromium.org,mythria@chromium.org Change-Id: I784b9eeff75a677b9f2276fa05a0d1af09772baa No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:5203 Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng Reviewed-on: https://chromium-review.googlesource.com/939401Reviewed-by:
Clemens Hammacher <clemensh@chromium.org> Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#51596}
-
Clemens Hammacher authored
There is a clear mistake of using kWasmF64 instead of kWasmF32. R=ahaas@chromium.org Change-Id: I638d568b3736fdb8417f17bcd04d17268a45b965 Reviewed-on: https://chromium-review.googlesource.com/939178Reviewed-by:
-
Ross McIlroy authored
Previously GetSharedFunctionInfoForStreamedScript didn't either check the compilation cache or put the result of compilation into the compilation cache. This would mean future compiles would need to re-parse / compile the same script even if the isolate had already seen it. This CL fixes this. Also refactors the compilation pipelines to ensure we call debug->OnAfterCompile() for all script compiles even when loading from a cache. BUG=v8:5203 Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng Change-Id: I0a74c5b67bfaca5e50511d5f72da0ab53d8457f6 Reviewed-on: https://chromium-review.googlesource.com/937724 Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
Mythri Alle <mythria@chromium.org> Cr-Commit-Position: refs/heads/master@{#51594}
-
Georgia Kouveli authored
Change-Id: I0e9ad97eb55e2bd206626e1f0734a05da3ba904c Reviewed-on: https://chromium-review.googlesource.com/934287 Commit-Queue: Georgia Kouveli <georgia.kouveli@arm.com> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#51593}
-
Ulan Degenbaev authored
Scavenger::PromoteObject and Scavenger::SemiSpaceCopyObject load and dereference the map of the object to compute the alignment. This is unsafe because the object can be already migrated by another thread and the map word can contain the forwarding address. This patch removes the map load and uses the provided map argument to compute the alignment. Bug: chromium:811278,chromium:807178 Change-Id: I7343344dc65ae26eefb2602c55dee87bb511bc72 Reviewed-on: https://chromium-review.googlesource.com/939172 Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Yang Guo <yangguo@chromium.org> Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/master@{#51592}
-
Marja Hölttä authored
BUG=v8:5402,v8:7310 Change-Id: I5861e6508668a751e458216961edd1a03192236b Reviewed-on: https://chromium-review.googlesource.com/934282 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by:
-
sreten.kovacevic authored
Implemented missing code for some LoadTypes. Use unaligned instructions for I64 Loads. Bug: v8:6600 Change-Id: I6ceb623005464c623eaa7512d3f1e4b0ebace86d Reviewed-on: https://chromium-review.googlesource.com/939167Reviewed-by:
Ivica Bogosavljevic <ivica.bogosavljevic@mips.com> Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com> Cr-Commit-Position: refs/heads/master@{#51590}
-
Michael Starzinger authored
This changes the encoding of the {HandlerTable} from an array of Smi values to a byte array. It allows embedding of said array into the instruction stream of {Code} objects (similar to how safepoint tables work). For interpreted bytecode the table is attached as a {ByteArray} to the bytecode. The advantage of this approach is a more compact encoding and also the ability to move such tables easily off the GC'ed heap if needed (as is done for WebAssembly code for example). R=jarin@chromium.org Change-Id: I3320415dff69b3d1053825bda0d667a28232bf6d Reviewed-on: https://chromium-review.googlesource.com/934642 Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by:Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
-
Choongwoo Han authored
Always return the given length (limit) for typed arrays in PrepareElementsForSort since typed arrays do not have holes. Bug: v8:6719 Change-Id: Ic455ceca6563fc66a4e4a78c7bf5df1ad17afb4a Reviewed-on: https://chromium-review.googlesource.com/615104Reviewed-by:
-
Camillo Bruni authored
Change-Id: I809b10935c92a129bd633c98759ba9d800aaa91c Reviewed-on: https://chromium-review.googlesource.com/934503Reviewed-by:
Peter Marshall <petermarshall@chromium.org> Commit-Queue: Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/master@{#51587}
-
Peter Marshall authored
Bug: v8:7310 Change-Id: I73f59cb4119e7f27828f09ac33fc247fc4983742 Reviewed-on: https://chromium-review.googlesource.com/937723Reviewed-by:
-
Kim-Anh Tran authored
Currently all instances share the exact same export wrappers (pointed to by the corresponding compiled module). This bug, however, does not cause a problem at runtime. This CL makes sure that all compiled modules have their own export wrapper table during instance instantiation. Change-Id: I385d79ab8ad42672f7ab72755387d161b1e9ee81 Reviewed-on: https://chromium-review.googlesource.com/937715 Commit-Queue: Kim-Anh Tran <kimanh@google.com> Reviewed-by:
-
Jakob Kummerow authored
Refactor the helpers to use return values instead of continuation functors. This reduces compilation time in Release mode from 30s to 10s (Debug: 10->7s). Also shorten the boilerplate code a bit. Bug: v8:7310 Change-Id: Icf6309e4fd5478a1f55979112d1219bc7eaf4e6d Reviewed-on: https://chromium-review.googlesource.com/938316 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
Adam Klein <adamk@chromium.org> Cr-Commit-Position: refs/heads/master@{#51584}
-
- 26 Feb, 2018 18 commits
-
-
Adam Klein authored
R=jkummerow@chromium.org Bug: v8:7497 Change-Id: I4b75fde49a352a6e8d99211efdbb09d77aa88069 Reviewed-on: https://chromium-review.googlesource.com/938183Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Adam Klein <adamk@chromium.org> Cr-Commit-Position: refs/heads/master@{#51583}
-
Adam Klein authored
This proposal has not moved beyoned stage 2 in two years, and has never moved past the HARMONY_INPROGRESS state in flag-definitions.h. It was originally added to aide in desugaring yield*, but is no longer used for that purpose. Bug: v8:4700, v8:7310 Change-Id: Ieca40d8e4bf565516bbe71e47b996daa70d2e835 Reviewed-on: https://chromium-review.googlesource.com/935297 Commit-Queue: Adam Klein <adamk@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#51582}
-
Adam Klein authored
The x87 port itself has been gone for awhile. Bug: v8:7310 Change-Id: I1c938ba93720af361733f2c09dc5f128173b5675 Reviewed-on: https://chromium-review.googlesource.com/935198Reviewed-by:
-
Junliang Yan authored
Port 3db1d4a5 Original Commit Message: Currently, atomic operations assume the default to be 32-bit operations, fix opcode names for differentiation between 32/64-bit operations. R=gdeepti@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com BUG= LOG=N Change-Id: I79c195ce7474f329ccb2446fad1f81bab41e7329 Reviewed-on: https://chromium-review.googlesource.com/937921Reviewed-by:
Joran Siu <joransiu@ca.ibm.com> Reviewed-by:
Deepti Gandluri <gdeepti@chromium.org> Commit-Queue: Junliang Yan <jyan@ca.ibm.com> Cr-Commit-Position: refs/heads/master@{#51580}
-
Wez authored
Recent Fuchsia SDKs have begun removing both symbols for unsupported POSIX APIs, and also the relevant definitions, and even headers. This CL: - Removes dependencies on <sys/resource.h>. - Adds a working implementation of GetUserTime(). - Fixes GetCurrentThreadId() to use the native (32-bit) Fuchsia thread handle, rather than the (64-bit) pthread*, to avoid potential for id clashes when truncating the value into a 32-bit int. Bug: chromium:707030 Change-Id: Ic5774e138f7657123dd65d0fb7ef5d87876766e8 Reviewed-on: https://chromium-review.googlesource.com/933247Reviewed-by:
Hannes Payer <hpayer@chromium.org> Commit-Queue: Wez <wez@chromium.org> Cr-Commit-Position: refs/heads/master@{#51579}
-
Adam Klein authored
This reverts commit 800daded. Reason for revert: breaks arm64 build Original change's description: > [turbofan] Masking/poisoning in codegen (optimized code, arm64) > > This introduces masking of loads with speculation bit during code generation. > At the moment, this is done only under the > --branch-load-poisoning flag, and this CL enlarges the set of supported > platforms from {x64, arm} to {x64, arm, arm64}. > > Overview of changes: > - new register configuration configuration with one register reserved for > the speculation poison/mask (kSpeculationPoisonRegister). > - in codegen, we introduce an update to the poison register at the starts > of all successors of branches (and deopts) that are marked as safety > branches (deopts). > - in memory optimizer, we lower all field and element loads to PoisonedLoads. > - poisoned loads are then masked in codegen with the poison register. > * only integer loads are masked at the moment. > > Bug: chromium:798964 > Change-Id: Ie6bc9c3bdac9998b0ef81f050a9c844399ca3ae4 > Reviewed-on: https://chromium-review.googlesource.com/928724 > Commit-Queue: Michael Stanton <mvstanton@chromium.org> > Reviewed-by: Martyn Capewell <martyn.capewell@arm.com> > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> > Cr-Commit-Position: refs/heads/master@{#51576} TBR=rmcilroy@chromium.org,mvstanton@chromium.org,mstarzinger@chromium.org,jarin@chromium.org,rodolph.perfetta@arm.com,martyn.capewell@arm.com,pierre.langlois@arm.com Change-Id: I1b5dad27f9620c7da3277602081f392de6221caf No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: chromium:798964 Reviewed-on: https://chromium-review.googlesource.com/937861Reviewed-by:
-
Gabriel Charette authored
This reverts commit c41c7a09. Reason for revert: relanding now that the perf waterfall has had a stab at this revert. Original change's description: > Revert "Use all available workers for concurrent marking." > > This reverts commit 3c62f7ae. > (and commit 4939463c) > > The goal of this revert is to contrast the effect on perf bots of > landing it vs reverting it to more easily attribute its impact. > > R=hpayer@chromium.org > > Bug: chromium:812178 > Change-Id: I7c977b1b0b587f787263272400d87f6aae7af634 > Reviewed-on: https://chromium-review.googlesource.com/936761 > Commit-Queue: Hannes Payer <hpayer@chromium.org> > Reviewed-by: Hannes Payer <hpayer@chromium.org> > Cr-Commit-Position: refs/heads/master@{#51546} TBR=gab@chromium.org,hpayer@chromium.org Change-Id: I1ecfc70867dc5424cba1a9ecd229ae031c3e9aa4 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: chromium:812178 Reviewed-on: https://chromium-review.googlesource.com/937725Reviewed-by:
-
Mike Stanton authored
This introduces masking of loads with speculation bit during code generation. At the moment, this is done only under the --branch-load-poisoning flag, and this CL enlarges the set of supported platforms from {x64, arm} to {x64, arm, arm64}. Overview of changes: - new register configuration configuration with one register reserved for the speculation poison/mask (kSpeculationPoisonRegister). - in codegen, we introduce an update to the poison register at the starts of all successors of branches (and deopts) that are marked as safety branches (deopts). - in memory optimizer, we lower all field and element loads to PoisonedLoads. - poisoned loads are then masked in codegen with the poison register. * only integer loads are masked at the moment. Bug: chromium:798964 Change-Id: Ie6bc9c3bdac9998b0ef81f050a9c844399ca3ae4 Reviewed-on: https://chromium-review.googlesource.com/928724 Commit-Queue: Michael Stanton <mvstanton@chromium.org> Reviewed-by: -
sreten.kovacevic authored
Implement Load and Store instructions for liftoff on MIPS. Function CallTrapCallbackForTesting also implemented to prevent test from failing when address is out of range. Bug: v8:6600 Change-Id: I85e48334d171ad6d86a02eeba51e4f07edaf9648 Reviewed-on: https://chromium-review.googlesource.com/934133 Commit-Queue: Sreten Kovacevic <sreten.kovacevic@mips.com> Reviewed-by:
-
Peter Marshall authored
Previously, Strings without an iterator would go to the runtime path and fail on because it expected a JSReceiver type. This was in-line with what the elements accessor expected. We can actually handle all object types in the final slow path (using LookupIterator) so it is no problem to change the accept types. Bug: chromium:816289 Change-Id: Iebb8de0bb7551aee3894c8a23836d079c93726a7 Reviewed-on: https://chromium-review.googlesource.com/937461Reviewed-by:
-
Clemens Hammacher authored
This is a reland of e7f9fb4a. Original change's description: > [Assembler][x64] Make Operand immutable > > This CL removes all setters from the Operand and removes the friendship > relation between Assembler and Operand. All data fields of the Operand > are set exactly once in the constructor, the Operand is immutable > afterwards. > In order to construct the data of an Operand easily, the OperandBuilder > is introduced. After building an Operand, the data is copied to the > const field of the Operand. > > R=mstarzinger@chromium.org > > Bug: v8:7310 > Change-Id: I1628052b8a0c47cbfbc3645dfdac5a0e9705977b > Reviewed-on: https://chromium-review.googlesource.com/936741 > Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> > Commit-Queue: Clemens Hammacher <clemensh@chromium.org> > Cr-Commit-Position: refs/heads/master@{#51563} Bug: v8:7310 Change-Id: I84df5e11b1811585fbba7309e3bb9c6b17e18c0b Reviewed-on: https://chromium-review.googlesource.com/936628Reviewed-by:
-
jgruber authored
These helpers support off-heap code objects, for which they return start, end, and size of the off-heap instruction stream. Bug: v8:6666 Change-Id: Ib5e819d976eee3073b0354b8d8ce324b691f1b15 Reviewed-on: https://chromium-review.googlesource.com/937281 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
-
jgruber authored
This is a reland of 087e9daa. Original change's description: > [builtins] Update off-heap-safe list > > TBR=yangguo@chromium.org > > Bug: v8:6666 > Change-Id: I70ba2ecbc259431b571a2e5611494dd7725f2aa6 > Reviewed-on: https://chromium-review.googlesource.com/937302 > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > Commit-Queue: Jakob Gruber <jgruber@chromium.org> > Cr-Commit-Position: refs/heads/master@{#51567} TBR=yangguo@chromium.org Bug: v8:6666 Change-Id: I9475c8e412f765623131f168e9fe25d8082d061e Reviewed-on: https://chromium-review.googlesource.com/937541Reviewed-by:
-
Yang Guo authored
R=jgruber@chromium.org Change-Id: I8328fdaf5d53850b87dd16867255d4325ab9cd9c Reviewed-on: https://chromium-review.googlesource.com/936644Reviewed-by:
-
Jakob Gruber authored
This reverts commit 087e9daa. Reason for revert: https://build.chromium.org/p/client.v8.ports/builders/V8%20Mips%20-%20builder/builds/15549 Original change's description: > [builtins] Update off-heap-safe list > > TBR=yangguo@chromium.org > > Bug: v8:6666 > Change-Id: I70ba2ecbc259431b571a2e5611494dd7725f2aa6 > Reviewed-on: https://chromium-review.googlesource.com/937302 > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > Commit-Queue: Jakob Gruber <jgruber@chromium.org> > Cr-Commit-Position: refs/heads/master@{#51567} TBR=yangguo@chromium.org,jgruber@chromium.org Change-Id: If37f28e0bfbd1fe495ec425d8306aa081e75eca4 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:6666 Reviewed-on: https://chromium-review.googlesource.com/937303Reviewed-by:
-
Clemens Hammacher authored
Refactor EmitUnOp to be templatized in the type and the emit function, similar to EmitBinOp. This simplified adding f32 and f64 unops. R=ahaas@chromium.org Bug: v8:6600 Change-Id: Iaab473a3bbcc45673ff6190d6b56244c48bfa5a6 Reviewed-on: https://chromium-review.googlesource.com/937201 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
-
jgruber authored
TBR=yangguo@chromium.org Bug: v8:6666 Change-Id: I70ba2ecbc259431b571a2e5611494dd7725f2aa6 Reviewed-on: https://chromium-review.googlesource.com/937302Reviewed-by:
-
Peter Marshall authored
I loosened the DCHECKs here but I think they are still fundamentally safe: `length` must be <= the actual length of the source (so that there are actually enough elements to copy), and `length` must also be <= the destination length, minus the offset (so there is enough space to copy the elements into). Bug: chromium:816317 Change-Id: Ice00ac60f4884363f6065ffee71f6ab1d1b32dbc Reviewed-on: https://chromium-review.googlesource.com/937209Reviewed-by:
-
