Skip to content

V
V8
Switch branch/tag
  1. 03 Jul, 2018 6 commits
    • Yang Guo's avatar
      Revert "[debug] liveedit in native" · 22594d10
      Yang Guo authored 
      This reverts commit 3dfaf826.

Reason for revert: Failures - https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Linux%20gcc%204.8/20394

Original change's description:
> [debug] liveedit in native
> 
> Liveedit step-by-step:
> 1. calculate diff between old source and new source,
> 2. map function literals from old source to new source,
> 3. create new script for new_source,
> 4. mark literals with changed code as changed, all others as unchanged,
> 5. check that for changed literals there are no:
>   - running generators in the heap,
>   - non droppable frames (e.g. running generator) above them on stack.
> 6. mark the bottom most frame with changed function as scheduled for
>    restart if any.
> 7. for unchanged functions:
>   - deoptimize,
>   - remove from cache,
>   - update source positions,
>   - move to new script,
>   - reset feedback information and preparsed scope information if any,
>   - replace any sfi in constant pool with changed one if any.
> 8. for changed functions:
>   - deoptimize
>   - remove from cache,
>   - reset feedback information,
>   - update all links from js functions to old shared with new one.
> 9. swap scripts.
> 
> TBR=ulan@chromium.org
> 
> Bug: v8:7862,v8:5713
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel;luci.chromium.try:linux_chromium_rel_ng;master.tryserver.blink:linux_trusty_blink_rel
> Change-Id: I8f6f6156318cc82d6f36d7ebc1c9f7d5f3aa1461
> Reviewed-on: https://chromium-review.googlesource.com/1105493
> Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
> Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#54146}

TBR=dgozman@chromium.org,ulan@chromium.org,yangguo@chromium.org,kozyatinskiy@chromium.org

Change-Id: I45df5b6f3abaf29e593c6ac11edefbd0177d0109
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7862, v8:5713
Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel;luci.chromium.try:linux_chromium_rel_ng;master.tryserver.blink:linux_trusty_blink_rel
Reviewed-on: https://chromium-review.googlesource.com/1124159Reviewed-by: 's avatarYang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54151}
      22594d10
    • Simon Zünd's avatar
      [array] Throw TypeError for read-only properties on fast-path · 93f59dee
      Simon Zünd authored 
      This CL changes the NumberDictionary fast-path for Array.p.sort to
throw a TypeError when trying to write to a read-only property.

Previously, the fast-path simply bailed to the slow-path which could
swallow the TypeError by accident. I.e. because the fast-path could
leave the array in an inconsistent state that is already sorted.

Example:

let arr = new Array(10);
Object.defineProperty(arr, 0, {value: 2, writable: false});
Object.defineProperty(arr, 2, {value: 1, writable: false});
arr.sort();

The pre-processing step will move the value 1 to index 1: {0: 2, 1: 1}
When trying to swap those 2 values, the fast-path will write the 2 at
index 1, then try to write the 1 at index 0 and fail, bailing to the
slow-path. As the array looks like {0: 2, 1: 2} its already sorted
and the TypeError will not be thrown.

R=jgruber@chromium.org

Bug: v8:7382, v8:7907
Change-Id: I5d2f2d73478fdca066ce1048dcb2b8301751cb1f
Reviewed-on: https://chromium-review.googlesource.com/1122120
Commit-Queue: Simon Zünd <szuend@google.com>
Reviewed-by: 's avatarJakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54150}
      93f59dee
    • Jakob Kummerow's avatar
      Fix overzealous assert in CallOrConstructVarArgs · 34225a6a
      Jakob Kummerow authored 
      For spread calls with arrays with double elements but zero length,
we skip the box-as-heapnumber step; so in this corner case the
Call builtin sees a FixedDoubleArray, which is fine because it
doesn't read any of the raw double values from it.
This patch doesn't change the implementation, it only updates the
assert to match reality.

Bug: chromium:856095
Change-Id: I0227f4ccbc6c61c8f5f7669a266ef7a64c6a9a43
Reviewed-on: https://chromium-review.googlesource.com/1117922Reviewed-by: 's avatarCamillo Bruni <cbruni@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54149}
      34225a6a
    • v8-ci-autoroll-builder's avatar
      Update V8 DEPS. · 55930aad
      v8-ci-autoroll-builder authored 
      Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/213a0e3..7ac2934

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/34f0d7e..153acbd

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/024a331..605dd31

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/dec27d7..39163b8

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I3ab6664ff80919f7169a14a9522c32b4c432a169
Reviewed-on: https://chromium-review.googlesource.com/1123884
Commit-Queue: V8 Autoroller <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Reviewed-by: 's avatarV8 Autoroller <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#54148}
      55930aad
    • jing.bao's avatar
      [ia32][wasm] Disallow using the same register for input and temp for I8x16Mul · a0782977
      jing.bao authored 
      Also improve its code generation.

Change-Id: I4358500a66b0d21cdc8850a4e63986c4901d3cf4
Reviewed-on: https://chromium-review.googlesource.com/1118005
Commit-Queue: Jing Bao <jing.bao@intel.com>
Reviewed-by: 's avatarBill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54147}
      a0782977
    • Alexey Kozyatinskiy's avatar
      [debug] liveedit in native · 3dfaf826
      Alexey Kozyatinskiy authored 
      Liveedit step-by-step:
1. calculate diff between old source and new source,
2. map function literals from old source to new source,
3. create new script for new_source,
4. mark literals with changed code as changed, all others as unchanged,
5. check that for changed literals there are no:
  - running generators in the heap,
  - non droppable frames (e.g. running generator) above them on stack.
6. mark the bottom most frame with changed function as scheduled for
   restart if any.
7. for unchanged functions:
  - deoptimize,
  - remove from cache,
  - update source positions,
  - move to new script,
  - reset feedback information and preparsed scope information if any,
  - replace any sfi in constant pool with changed one if any.
8. for changed functions:
  - deoptimize
  - remove from cache,
  - reset feedback information,
  - update all links from js functions to old shared with new one.
9. swap scripts.

TBR=ulan@chromium.org

Bug: v8:7862,v8:5713
Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel;luci.chromium.try:linux_chromium_rel_ng;master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I8f6f6156318cc82d6f36d7ebc1c9f7d5f3aa1461
Reviewed-on: https://chromium-review.googlesource.com/1105493Reviewed-by: 's avatarAleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: 's avatarDmitry Gozman <dgozman@chromium.org>
Reviewed-by: 's avatarYang Guo <yangguo@chromium.org>
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54146}
      3dfaf826
  3. 02 Jul, 2018 26 commits
  5. 01 Jul, 2018 1 commit
  7. 30 Jun, 2018 1 commit
  9. 29 Jun, 2018 6 commits