- 09 May, 2018 11 commits
-
-
Hannes Payer authored
Change-Id: I14237a71c34872e114d7e2afb73a758e011fd731 Reviewed-on: https://chromium-review.googlesource.com/1051239Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Hannes Payer <hpayer@chromium.org> Cr-Commit-Position: refs/heads/master@{#53092}
-
Mike Stanton authored
BUG=v8:7672 Change-Id: I0c157ce88b31312dfbea7a149c1d9fbdfb398278 Reviewed-on: https://chromium-review.googlesource.com/1013524 Commit-Queue: Michael Stanton <mvstanton@chromium.org> Reviewed-by:
Daniel Clifford <danno@chromium.org> Cr-Commit-Position: refs/heads/master@{#53091}
-
Hannes Payer authored
Change-Id: Ia4d4211dbc8f0714dd11983ac7bc899f51ba69c5 Reviewed-on: https://chromium-review.googlesource.com/1051237Reviewed-by:
-
Clemens Hammacher authored
After closing a handle scope, and when allocating a new segment in a zone, treat that memory as uninitialized in MSan. This will hopefully catch more errors than handle zapping, which needs to be enabled explicitly. R=ahaas@chromium.org Bug: v8:7570 Change-Id: Ie3be07434bed878fb607a522787514421f397197 Reviewed-on: https://chromium-review.googlesource.com/1046657 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/master@{#53089}
-
Clemens Hammacher authored
The comment in {CallRuntime} was misleading. The {rsi}/{esi} register did not hold the instance, but the context instead. The generated code was correct thought. R=titzer@chromium.org Change-Id: I18020a04ac75faedf7ad5e4b07cab27ae0aedae7 Reviewed-on: https://chromium-review.googlesource.com/1051232Reviewed-by:Ben Titzer <titzer@chromium.org> Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#53088}
-
Dan Elphick authored
This is a reland of 40f1aaf3 Put back padding clearing into the SerializeObject method but only when the String is not in RO_SPACE. For RO_SPACE strings, if required iterate over the space before serialization clearing the strings. Original change's description: > [heap] Mark RO_SPACE as read-only after deserialization > > Adds MarkAsReadOnly and MarkAsReadWrite to ReadOnlySpace. The latter > is only usable with ReadOnlySpace::WritableScope to avoid the space > being left writable). MarkAsReadOnly updates the high water mark and > makes several previously mutating methods into no-ops. > > Moves some writes to immutable objects out of the bootstrapper to > setup-heap-internal so they don't write to a read-only page. > > Also avoid writing hashes to strings that already have the value set as > that invariably means writing to the "0" and "1" constant strings in > RO_SPACE. > > Before serialization, it makes RO_SPACE writable again so that any > padding can be cleared before writing it. > > Bug: v8:7464 > Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng > Change-Id: I22edc20dba7dde8943991a8fcaf87244af4490a3 > Reviewed-on: https://chromium-review.googlesource.com/1014128 > Commit-Queue: Dan Elphick <delphick@chromium.org> > Reviewed-by: Hannes Payer <hpayer@chromium.org> > Reviewed-by: Yang Guo <yangguo@chromium.org> > Cr-Commit-Position: refs/heads/master@{#52943} Bug: v8:7464 Change-Id: Ia8386c4ff5f5df3207f584caf7a9b1ff1e405f25 Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng Reviewed-on: https://chromium-review.googlesource.com/1042145Reviewed-by:
Hannes Payer <hpayer@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Commit-Queue: Dan Elphick <delphick@chromium.org> Cr-Commit-Position: refs/heads/master@{#53087}
-
Ben L. Titzer authored
This CL removes the JSGraph from WasmGraphBuilder and uses MachineGraph, which is independent of the isolate, instead. In addition to using the machine graph in the WasmGraphBuilder, this CL splits off a subclass for compiling wrappers that does have a JSGraph and encapsulates it in the .cc file. This makes the separation of WASM function graphs and WASM wrapper graphs more explicit. R=mstarzinger@chromium.org CC=ahaas@chromium.org BUG=v8:7721 Change-Id: I3c190baef2084919d22a9a89a8c9f11d2ddcf3d0 Reviewed-on: https://chromium-review.googlesource.com/1050266 Commit-Queue: Ben Titzer <titzer@chromium.org> Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#53086}
-
Peter Marshall authored
The handles created for each SharedFunctionInfo within SourcePosition::InliningStack live for the life of the profile, reaching 5MiB+ on an example server application for Node. This HandleScope limits their lifetime locally, given that the handles do not escape. This saves ~10% of peak memory. Bug: v8:7719 Change-Id: I97ce0fd3658be89fdd9cb9c1369ea5bfae0ce579 Reviewed-on: https://chromium-review.googlesource.com/1049647Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Reviewed-by:
Alexei Filippov <alph@chromium.org> Commit-Queue: Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#53085}
-
Michael Starzinger authored
This makes sure that the {WasmModuleObject} has been allocated before any debug events are fired. Since {WasmScript} objects reference the module object, it needs to be allocated earlier by now. R=ahaas@chromium.org TEST=debugger/regress/regress-crbug-840288 BUG=chromium:840288 Change-Id: I02783ce126c463ac953eb2192acb65f3a5d420a1 Reviewed-on: https://chromium-review.googlesource.com/1050246Reviewed-by: -
Jaroslav Sevcik authored
Bug: chromium:841117 Change-Id: I1e83dfc82f87d0b49d3cca96290ae1d738e37d20 Reviewed-on: https://chromium-review.googlesource.com/1051228Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#53083}
-
Michael Achenbach authored
This reverts commit e084eea6. Reason for revert: https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20UBSanVptr/builds/3163 Original change's description: > Fix SourcePositionInfo for wasm > > In wasm we often don't have a SharedFunctionInfo associated with a > compilation job, so we can't get a Script. Just print "unknown" in > these cases (instead of crashing). > > R=titzer@chromium.org > CC=herhut@chromium.org > > Bug: chromium:840757, v8:7738 > Change-Id: I850c6adfd9e07c9a0f6dd018f1a9314feb89d887 > Reviewed-on: https://chromium-review.googlesource.com/1049632 > Commit-Queue: Clemens Hammacher <clemensh@chromium.org> > Reviewed-by: Ben Titzer <titzer@chromium.org> > Cr-Commit-Position: refs/heads/master@{#53080} TBR=titzer@chromium.org,clemensh@chromium.org Change-Id: Ib2020ea3f2b778df9fe50ccbe803938f2f4fd709 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: chromium:840757, v8:7738 Reviewed-on: https://chromium-review.googlesource.com/1051265Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/master@{#53082}
-
- 08 May, 2018 29 commits
-
-
Junliang Yan authored
Port d8131cd6 Original Commit Message: Stubs and builtins are very similar. The main differences are that stubs can be parameterized and may be generated at runtime, whereas builtins are generated at mksnapshot-time and shipped with the snapshot (or embedded into the binary). My main motivation for these conversions is that we can generate faster calls and jumps to (embedded) builtins callees from (embedded) builtin callers. Instead of going through the builtins constants table indirection, we can simply do a pc-relative call/jump. This also unlocks other refactorings, e.g. removal of CallRuntimeDelayed. R=jgruber@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com BUG= LOG=N Change-Id: I193e4275470d492912a7d0f8523c3b8c29f1b146 Reviewed-on: https://chromium-review.googlesource.com/1050732 Commit-Queue: Junliang Yan <jyan@ca.ibm.com> Reviewed-by:
Joran Siu <joransiu@ca.ibm.com> Cr-Commit-Position: refs/heads/master@{#53081}
-
Clemens Hammacher authored
In wasm we often don't have a SharedFunctionInfo associated with a compilation job, so we can't get a Script. Just print "unknown" in these cases (instead of crashing). R=titzer@chromium.org CC=herhut@chromium.org Bug: chromium:840757, v8:7738 Change-Id: I850c6adfd9e07c9a0f6dd018f1a9314feb89d887 Reviewed-on: https://chromium-review.googlesource.com/1049632 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
-
Hannes Payer authored
This reverts commit 494068c1. Reason for revert: https://bugs.chromium.org/p/chromium/issues/detail?id=840282 Original change's description: > [heap] Clear from space after garbage collection. > > Bug: chromium:829771 > Change-Id: I9e71e6cbba347dd6951e5415332e5178df9b5122 > Reviewed-on: https://chromium-review.googlesource.com/1041685 > Commit-Queue: Hannes Payer <hpayer@chromium.org> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Cr-Commit-Position: refs/heads/master@{#52957} TBR=hpayer@chromium.org,mlippautz@chromium.org Bug: chromium:829771 Change-Id: I3c36baaf849a7d5dbf48db2ae2178e15b3b886f8 Reviewed-on: https://chromium-review.googlesource.com/1049888 Commit-Queue: Hannes Payer <hpayer@chromium.org> Reviewed-by:
-
Eric Holk authored
D8 enables the Wasm trap handler by default now, but we need to make sure the older bounds check case still gets test coverage too, as bounds checks will continue to be a supported configuration. Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng Change-Id: I5b0bdded6929a9b3a8480e87d038398b8d2a0fd8 Reviewed-on: https://chromium-review.googlesource.com/1048835Reviewed-by:
-
Dan Elphick authored
Removes lots of parameters that are never used (found using -Wunused-parameter). Also wires up the pretenure parameter for Factory::NewFrameArray so it's actually used. Change-Id: I486e22ac0683afb84bba6a286947674254f93832 Reviewed-on: https://chromium-review.googlesource.com/1041687Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
-
Clemens Hammacher authored
Next SSCA mitigation: Mask the function index on indirect calls. This avoids speculative jumps to arbitrary memory. R=titzer@chromium.org Bug: v8:6600, chromium:798964 Change-Id: Id4a54fbb42096655d48965b63202bb58f98dc9aa Reviewed-on: https://chromium-review.googlesource.com/1049627 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
-
Leszek Swirski authored
Change-Id: I2afefab5bf43abee5e5dc66224cea1c68fb85179 Reviewed-on: https://chromium-review.googlesource.com/1049973Reviewed-by:
-
Alexey Kozyatinskiy authored
If termination was requested on pause we should handle it properly as soon as execution resumed. R=yangguo@chromium.org Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel Change-Id: Ica50500094138097f115545db716264126fbe59e Reviewed-on: https://chromium-review.googlesource.com/1049486 Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org> Reviewed-by:
Yang Guo <yangguo@chromium.org> Reviewed-by:
-
Clemens Hammacher authored
Similar to msan.h, asan should get its own header file such that the functionality can be reused. R=ahaas@chromium.org Bug: v8:7570 Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng Change-Id: Ib81e4ff4b1d08158df7730c32345d4facf9453b0 Reviewed-on: https://chromium-review.googlesource.com/1046656Reviewed-by:
-
Andreas Haas authored
In addition to a git grep I ran the virtual/enable_wasm_streaming/http/tests/wasm_streaming/wasm_response_apis.html layout test locally to confirm that the flag is not used in Chrome. R=titzer@chromium.org Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng Change-Id: I00d013b85b585d26e50aacaeb82fb0b1ce1ff56c Reviewed-on: https://chromium-review.googlesource.com/1049965Reviewed-by:
-
Clemens Hammacher authored
Currently, non-msan builds don't check the arguments for MSAN_ALLOCATED_UNINITIALIZED_MEMORY and MSAN_MEMORY_IS_INITIALIZED calls, so type errors will only be reported on the msan builder. This CL adds static_asserts for non-msan builds. Drive-by: Rename MEMORY_SANITIZER to V8_USE_MEMORY_SANITIZER and move it to macros.h, where also other such macros (like V8_USE_ADDRESS_SANITIZER) live. R=ahaas@chromium.org Bug: v8:7570 Change-Id: If6c3c6e0d1287b5f1e0c59828cd028d1beac933d Reviewed-on: https://chromium-review.googlesource.com/1046655Reviewed-by:
-
Leszek Swirski authored
Fixes the MaybeObject->Object conversion in ObjectStats to allow Smis, rather than just HeapObjects. Change-Id: I845613c47bb6ca696d444a025100b471fb385980 Reviewed-on: https://chromium-review.googlesource.com/1049925Reviewed-by:
Marja Hölttä <marja@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/master@{#53070}
-
Tobias Tebbi authored
Change-Id: Ibb6e10caaa4fcdb29c35baef71cf1b4faef45bc4 Reviewed-on: https://chromium-review.googlesource.com/1042389Reviewed-by:
-
Michael Achenbach authored
When a custom workdir is used for the checkout, it differs from the workdir for temporary state files. In this case, code ensuring the existing of the parent dir wasn't executed. NOTRY=true Bug: v8:7735 Change-Id: Idc81b50bb8f880dea45fde08ba4d437c91e96a37 Reviewed-on: https://chromium-review.googlesource.com/1049552Reviewed-by:
Michael Hablich <hablich@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/master@{#53068}
-
Camillo Bruni authored
Loading the length from a PropertyArray is currently broken. Bug: v8:7732 Change-Id: Ia05f314f2f4822a8821801889b7a58f75b3f198c Reviewed-on: https://chromium-review.googlesource.com/1049610Reviewed-by:
-
Simon Zünd authored
To stay compatible with JSC, Array.p.sort did a post-processing step that shadowed elements from the prototype chain. Some time ago, JSC changed and no longer exhibits this behavior. To preserve comptibility and stay consistent with RemoveArrayHoles, this CL removes this post-processing step altogether and adjusts tests to expect the new behavior. R=cbruni@chromium.org, jgruber@chromium.org Bug: v8:7382 Change-Id: Iecedc37cea25001d3768b99a3a9de3a2db90ba82 Reviewed-on: https://chromium-review.googlesource.com/1047286 Commit-Queue: Simon Zünd <szuend@google.com> Reviewed-by:
Camillo Bruni <cbruni@chromium.org> Reviewed-by:
-
Choongwoo Han authored
Remove InitialArrayPrototypeHasInitialArrayPrototypeMap and HasInitialFastElementsKindMap introduced by http://crrev.com/55efb6cc5dd0ae28b9cc41da31fe86069487c113, but not used after http://crrev.com/1525374ff5a564b55b748ad33e6cd0d0ea684006. Change-Id: I1182221a95d5fc1ac953139e400533efe420bd19 Reviewed-on: https://chromium-review.googlesource.com/1045951Reviewed-by:
-
Clemens Hammacher authored
Code comments help a lot to understand the generated code. Add a comment before each instruction, and some special comments for longer instructions. R=titzer@chromium.org Bug: v8:6600 Change-Id: Ic18974e5cc89e23533e3abc54b0389723b77ff73 Reviewed-on: https://chromium-review.googlesource.com/1049626 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
-
Choongwoo Han authored
Bug: v8:7103 Change-Id: I86e208de38aad1d41c65d39b94996012efa1346b Reviewed-on: https://chromium-review.googlesource.com/1045949 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
-
jgruber authored
Embedded builtins have been regressing benchmarks incrementally as more and more builtins were moved to the embedded blob. This has made recognition and analysis of other possible performance issues more difficult. Let's disable embedded builtins until their performance is at an acceptable level. Bug: v8:6666 Change-Id: I21a1274f3d5a65063127b0a8604df6dd0d3c0c95 Reviewed-on: https://chromium-review.googlesource.com/1049550 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
-
Simon Zünd authored
This CL re-implements CopyFromPrototype, that is used during sorting, as a runtime function, in preparation to move Array.p.sort to CSA. CopyFromPrototype is called for sparse non-arrays, where elements might be available on the prototype chain. For compatibility with JSC, we copy them to the object itself and sort only own properties. Bug: v8:7382 Change-Id: I4f5c14995cf9769c4f9f1d62b3a5bfde6d386556 Reviewed-on: https://chromium-review.googlesource.com/1044205 Commit-Queue: Simon Zünd <szuend@google.com> Reviewed-by:
-
Simon Zünd authored
This CL implements the functionality of SafeRemoveArrayHoles (JS), which is used as a pre-processing step for sorting, in a runtime function. SafeRemoveArrayHoles is a generic fallback, when an existing runtime function fails to remove holes/move undefineds to the end of an array. This CL extends the existing runtime function to also support JSProxy objects, and objects where indices have accessors. R=cbruni@chromium.org, jgruber@chromium.org Bug: v8:7382 Change-Id: I4881539cf2171caba08ff6e3e50320291f49839c Reviewed-on: https://chromium-review.googlesource.com/1041950 Commit-Queue: Simon Zünd <szuend@google.com> Reviewed-by:
-
Clemens Hammacher authored
On system which required a contiguous code range, we currently limit the committed wasm code space to the heap code space. Since https://crrev.com/c/1044195, this was only 128MB, making bigger benchmarks fail. There is no need to link the two limits, thus just remove that logic. R=titzer@chromium.org Change-Id: Id61f5dd28c96c3d2b7fcd730751285c6fc144bc5 Reviewed-on: https://chromium-review.googlesource.com/1049648Reviewed-by:
-
Michael Starzinger authored
This shares JS-to-Wasm wrapper code across instances belonging to the same module object. We no longer need to copy the wrappers since they are by now independent of the concrete instance. R=titzer@chromium.org BUG=v8:7424 Change-Id: I54188eae6378e53cc274cd19f8e652ffdba72ee5 Reviewed-on: https://chromium-review.googlesource.com/1049607 Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by:
-
Michael Starzinger authored
This changes JS-to-Wasm wrappers to no longer embed a WeakCell with the associated instance into the code, but load the instance object from the passed {WasmExportedFunction} object instead. R=titzer@chromium.org BUG=v8:7424 Change-Id: I5403f882912eb23e760fabe70207440648754a69 Reviewed-on: https://chromium-review.googlesource.com/1028053 Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by: -
Dan Elphick authored
This reverts commit b19d123f. Reason for revert: It breaks the more important change: https://chromium-review.googlesource.com/c/v8/v8/+/1042145 (Because it adds mutable objects to RO_SPACE). Original change's description: > [heap] Move even more objects into RO_SPACE > > Moves all Oddballs, empty_feedback_metadata, lots of symbols and > immortal heap numbers and several other empty collection objects. > > RO_SPACE NEW_SPACE OLD_SPACE CODE_SPACE MAP_SPACE LO_SPACE > old 31592 0 221160 33280 176 0 > new 35016 0 217736 33280 176 0 > diff +3424 -3424 > > Bug: v8:7464 > Change-Id: Ic99411bcbcb9c9a48b33c59dddb68359278fb0b3 > Reviewed-on: https://chromium-review.googlesource.com/1025996 > Commit-Queue: Dan Elphick <delphick@chromium.org> > Reviewed-by: Hannes Payer <hpayer@chromium.org> > Cr-Commit-Position: refs/heads/master@{#53053} TBR=hpayer@chromium.org,mlippautz@chromium.org,delphick@chromium.org Change-Id: Ieb81f88fe348fcffb67c153c0b116670318814f5 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:7464 Reviewed-on: https://chromium-review.googlesource.com/1049555Reviewed-by:
Dan Elphick <delphick@chromium.org> Commit-Queue: Dan Elphick <delphick@chromium.org> Cr-Commit-Position: refs/heads/master@{#53056}
-
Ivo Markovic authored
at register is used a lot in macro-assembler-mips[64].cc and we should not use it as temporary register in other parts of code Change-Id: I7ef038cdf4f8c57aa76823e7ee0ffb40b62731cd Reviewed-on: https://chromium-review.googlesource.com/1027816 Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com> Reviewed-by:
Sreten Kovacevic <sreten.kovacevic@mips.com> Cr-Commit-Position: refs/heads/master@{#53055}
-
Ben L. Titzer authored
R=mvstanton@chromium.org CC=mstarzinger@chromium.org Bug: v8:7721 Change-Id: I8baf4c8d52d0a5bd4a3b8d832624438f465f9390 Reviewed-on: https://chromium-review.googlesource.com/1047609Reviewed-by:
Michael Stanton <mvstanton@chromium.org> Commit-Queue: Ben Titzer <titzer@chromium.org> Cr-Commit-Position: refs/heads/master@{#53054}
-
Dan Elphick authored
Moves all Oddballs, empty_feedback_metadata, lots of symbols and immortal heap numbers and several other empty collection objects. RO_SPACE NEW_SPACE OLD_SPACE CODE_SPACE MAP_SPACE LO_SPACE old 31592 0 221160 33280 176 0 new 35016 0 217736 33280 176 0 diff +3424 -3424 Bug: v8:7464 Change-Id: Ic99411bcbcb9c9a48b33c59dddb68359278fb0b3 Reviewed-on: https://chromium-review.googlesource.com/1025996 Commit-Queue: Dan Elphick <delphick@chromium.org> Reviewed-by:
-
