- 03 Jun, 2020 31 commits
-
-
Andreas Haas authored
All subtyping has been removed from the reference-types proposal. This CL implements this proposal change now in V8. R=manoskouk@chromium.org Bug: v8:10556 Change-Id: I08ef064952278e03ea655461fa9f0c96426157c7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2222345 Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#68152}
-
Thibaud Michaud authored
We already track register usage, so we can stop as soon as all registers are spilled. Also iterate the stack backwards, since the bottom of the stack is more likely to be already spilled. R=clemensb@chromium.org Bug: v8:10576 Change-Id: I06fe8efe257dd5b8bcb426b4e79a8815a8cb5c81 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2228494 Commit-Queue: Thibaud Michaud <thibaudm@chromium.org> Reviewed-by:
Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#68151}
-
Michael Lippautz authored
This ports HeapStatsCollector (former ThreadHeapStatsCollector) from Blink. The CL only ports accounting of allocated object size which is needed for a simple growing strategy in a follow up. HeapStatsCollector is a global dependency for most sub components as it provides infrastructure for measuring time (through trace scopes) and space. The general idea of HeapStatsCollector is to act as sink where all sub components push time and space information. This information is then gathered and made available via an event that is implemented as POD. Time-dependent info is available through regular getters (pull) and observers (push). Change-Id: I40b4d76e1a40c56e5df1a7353622318cde730e26 Bug: chromium:1056170 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2225902 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Anton Bikineev <bikineev@chromium.org> Reviewed-by:
Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/master@{#68150}
-
Santiago Aboy Solanes authored
This CL makes it so that we revisit nodes in the revisit queue as soon as possible in RETYPE and PROPAGATE. This is done to revisit loops related to backedges before moving onto other nodes. Bug: v8:10424 Change-Id: I432c6551805903072b3f9fbc867adca82b263325 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2157373Reviewed-by:
Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Cr-Commit-Position: refs/heads/master@{#68149}
-
Andreas Haas authored
Even in unreachable code, the targets of br_table have to have matching types. R=thibaudm@chromium.org Bug: v8:10556 Change-Id: I2e85df3cb92f7910a6bcb5ac03927c424194660d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2218062 Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by:
Thibaud Michaud <thibaudm@chromium.org> Cr-Commit-Position: refs/heads/master@{#68148}
-
Manos Koukoutos authored
Add some abstractions to make it easier to define more tests. Bug: v8:7748 Change-Id: Ia5605aa10963228eb4bfba37e2b412fc5af860d8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2224212 Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Reviewed-by:
-
Junliang Yan authored
1) Rename remembered-set-inl.h back to remembered-set.h 2) Introduce a new remembered-set-inl.h and move the function definition that depends on ptr-compr-inl.h. Change-Id: I0e16e1e428937184ff255471937c70e6bb65a11e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2223816 Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
-
Clemens Backes authored
When tiering down (or up), we first get a list of all native modules (under a lock), then tier them down/up without holding the lock. Since we don't hold (shared) ownership of the native module, it could die in-between. This CL fixes this by keeping weak pointers to the native modules, and re-gaining a shared pointer before putting the module in the list of modules to be tiered down/up. R=thibaudm@chromium.org Bug: v8:10588 Change-Id: I2891c3729f42f26d4026f3e2448e124863b95122 Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_isolates_rel_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2228515 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by:
-
Michael Lippautz authored
No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: chromium:1056170 Change-Id: I0f8d0a4e79fa3a526151efe3317546862aff70bb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2228333 Auto-Submit: Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
-
Arnaud Robin authored
Added return value display when tracing function calls in wasm. The new types handled are I32, I64, F32 and F64. Only single return value is handled. R=clemensb@chromium.org Bug: v8:10559 Change-Id: I726d08fcfdc8bf2c3e43a25ec1932412ff74387b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2225024Reviewed-by:
-
Mythri A authored
This is a followup of the cl [1] that fixes a bug where bytecode was getting flushed when allocating feedback vector. The fix added IsCompiledScope before allocating a new feedback vector. We now pass IsCompiledScope to JSFunction::EnsureFeedbackVector. This makes it explicit that EnsureFeedbackVector expects a function that is compiled and the bytecode shouldn't be flushed during the allocation.Also adds a test. [1] https://chromium-review.googlesource.com/c/v8/v8/+/2218066 Bug: v8:10560 Change-Id: I552c449a57555dffa625b2e4efa04c2c276fc0b4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2222347 Commit-Queue: Mythri Alle <mythria@chromium.org> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
-
Andreas Haas authored
With recent changes to the anyref proposal, null refs now have a type immediate which declares the type of a null ref constant. Likewise, the RefIsNull instruction is type aware now. This CL addresses these proposal changes now. R=jkummerow@chromium.org Bug: v8:10556 Change-Id: I810dfa3a4ab4389afc9639f897cee5d43e9b62cb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2215172 Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by:
-
Dan Elphick authored
Now ReadOnlySpace is not a Space, it cannot be upcasted to it, so cast to BaseSpace as well. Fixes ubsan failure introduced by https://chromium-review.googlesource.com/c/v8/v8/+/2209060. Bug: v8:10454 Change-Id: I2936bfd8349377b441be4a6eedf580d91f1c4ee4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2228723 Commit-Queue: Dan Elphick <delphick@chromium.org> Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Auto-Submit: Dan Elphick <delphick@chromium.org> Reviewed-by:
-
Michael Lippautz authored
Bug: chromium:1056170 Change-Id: I7cb19e19de63a74e5407665c28f1b5c0f23d7d0e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2226563 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
Yang Guo <yangguo@chromium.org> Cr-Commit-Position: refs/heads/master@{#68139}
-
Zhao Jiazhong authored
Port aa5bcc09 https://crrev.com/c/2225090 Change-Id: Ib3b159ebcee0d4da5ce003b08d02cd36b7218016 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2228097Reviewed-by:
-
Dan Elphick authored
This changes ReadOnlySpace to no longer be a PagedSpace but instead it is now a BaseSpace. BasicSpace is a new base class that Space inherits from and which has no allocation methods and does not dictate how the pages should be held. ReadOnlySpace unlike Space holds its pages as a std::vector<ReadOnlyPage>, where ReadOnlyPage directly subclasses BasicMemoryChunk, meaning they do not have prev_ and next_ pointers and cannot be held in a heap::List. This is desirable since with pointer compression we would like to remap these pages to different memory addresses which would be impossible with a heap::List. Since ReadOnlySpace no longer uses most of the code from the other Spaces it makes sense to simplify its memory allocation to use a simple bump pointer and always allocate a new page whenever an allocation exceeds the remaining space on the final page. Change-Id: Iee6d9f96cfb174b4026ee671ee4f897909b38418 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2209060 Commit-Queue: Dan Elphick <delphick@chromium.org> Reviewed-by:
-
Jakob Gruber authored
This brings %DebugPrint(string) closer to %DebugPrint(object) by also including the pointer, object kind, and RO/old space. Especially the pointer can be useful while debugging. One could consider going even further end printing full details of the string object, e.g. first and second pointers for cons strings. Before: $ out/debug/d8 --allow-natives-syntax -e '%DebugPrint("abc");' DebugPrint: #abc 0x263f080402cd: [Map] in ReadOnlySpace [...] After: $ out/debug/d8 --allow-natives-syntax -e '%DebugPrint("abc");' DebugPrint: 0xa830824ffe1: [String] in OldSpace: #abc 0xa83080402cd: [Map] in ReadOnlySpace [...] Drive-by: Document string printing functions. Drive-by: Use PrintUC16 in spots that don't want a full debug print. Bug: v8:10581 Change-Id: Ided59047b9c3edc1830ce7721376dddfd24fad1d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2228509Reviewed-by: -
Igor Sheludko authored
... in order to make it possible to collect zone memory usage stats from Chrome. Drive-by-cleanup: move TracingFlags definition to a separate file. Bug: v8:10572 Change-Id: I05fb65e207d573d5c18821067cfff4c37f2d77cd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2226561Reviewed-by:
Peter Marshall <petermarshall@chromium.org> Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#68135}
-
Dan Elphick authored
This moves several fields that will be needed by ReadOnlySpace pages when it stops using MemoryChunk into BasicMemoryChunk. Additionally AllocationStats is moved from spaces.h into allocation-stats.h. Bug: v8:10473, v8:10454 Change-Id: I76a66565a260126e629bd7588a5418267dfa8423 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2228722Reviewed-by:
-
Igor Sheludko authored
... collected via --trace-zone-stats flag or v8.zone_stats trace category. This is an initial version inspired by heap-stats UI. Bug: v8:10572 Change-Id: Ib87cf0b4e120bc99683227eef02668a2a5c3d594 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2226855Reviewed-by:
Camillo Bruni <cbruni@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#68133}
-
Peter Ralbovsky authored
Fuzzilli is open source fuzzer by Samuel Groß (saelo@google.com) that can be used to find bugs in v8 javascript engine. As we want to automate fuzzing for current versions of v8, we want to merge fuzzilli toolkit into v8 code, so that fuzzer can automatically update to the newest version. So far Fuzzilli has been maintained at https://github.com/googleprojectzero/fuzzilli . Bug tracker Id: https://bugs.chromium.org/p/v8/issues/detail?id=10571 Change-Id: I83ddc7e8bb31664c19e4044395bb9044a1c12031 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2201760Reviewed-by:
Tamer Tas <tmrts@chromium.org> Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Reviewed-by:
Michael Stanton <mvstanton@chromium.org> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Michael Stanton <mvstanton@chromium.org> Cr-Commit-Position: refs/heads/master@{#68132}
-
Camillo Bruni authored
Passing tests that are marked as fail in a status file are not immediately visible as such. - Always show "--- FAILED ---" for failing tests - Show "--- UNEXPECTED PASS ---" for unexpectedly passing tests Drive-by-fixes: - Color failures in red with --progress=color - Color repro command in yellow with --progress=color Change-Id: Id43ecec348dbfd4ff627ea6aa4ba458a2e5a8445 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2213434Reviewed-by:
-
Thibaud Michaud authored
On x86-64, we spend significant time constructing and copying operands in Liftoff (around 5% locally). Inlining the constructor and helper functions removes most of the overhead. R=clemensb@chromium.org Bug: v8:10576 Change-Id: I1663e3e92abe7683eba9320e77fce9be8f84b4ca Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2225023 Commit-Queue: Thibaud Michaud <thibaudm@chromium.org> Reviewed-by:
-
Iain Ireland authored
https://crrev.com/c/2072858 rewrote the implementation of non-unicode ignore-case matches to comply with the JS spec in some corner cases. It fixed character matches and character class matches. We missed a similar bug in the implementation of back references. This CL fixes that bug. The main change is in regexp-macro-assembler.cc, where CaseInsensitiveCompareUC16 is split into CaseInsensitiveCompareUnicode (which has the same semantics as before) and CaseInsensitiveCompareNonUnicode (which has the semantics described here: https://tc39.es/ecma262/#sec-runtime-semantics-canonicalize-ch). Most of the rest of the patch undoes https://crrev.com/c/2081816 to once again make the unicode flag available to the macroassembler, so that we can decide which helper function to call. The testcase is a version of test/intl/regress-10248.js, modified to test backreferences. Bug: v8:10573 Change-Id: I70ef7d134d37f99b1f75a5eba17020e82d59f1b9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2219284Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#68129}
-
Jakob Gruber authored
This CL makes the test stricter by requiring specific string shapes; before it was possible to skip verification if strings were short-circuited, which I believe is no longer possible due to thin strings. I also added a regression test for the linked bug, which requires a String.p.split call on a two-byte-in-one-byte string with an empty string separator argument. Bug: chromium:1088179 Change-Id: Ibb3180afe612a64fcf6a506d18bbc415840526a8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2228609Reviewed-by:
-
Dominik Inführ authored
Bug: v8:10315 Change-Id: I0144b89696933afcd02f63b0440118dd33a7d5ad Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2225025Reviewed-by:
-
Georg Neis authored
Also change the component from Runtime to Compiler. Change-Id: Ifb19e0d584b279b5f9bc6bc60531e64d4fecb4ad Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2218285 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#68126}
-
Anton Bikineev authored
This fixes the gcov build. Bug: chromium:1056170 Change-Id: I40ac42b6fce77367c6a366544abf89fc21075cdc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2228510 Commit-Queue: Anton Bikineev <bikineev@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Anton Bikineev <bikineev@chromium.org> Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
-
Jakob Gruber authored
It's possible for a one-byte string to wrap a two-byte string. For example: CONS_ONE_BYTE_STRING_TYPE wraps THIN_STRING_TYPE wraps EXTERNAL_INTERNALIZED_STRING_TYPE We thus have to validate the extracted instance type when relying on the string being one-byte. Bug: chromium:1088179 Change-Id: Id0f996761a3ae2f1233e12c95e663e77d4a5ebf9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2226752Reviewed-by: -
Ng Zhi An authored
Bug: v8:10180 Change-Id: Ic3dc7394962439adca0482750593a1c22c840054 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2225091Reviewed-by:
Deepti Gandluri <gdeepti@chromium.org> Commit-Queue: Zhi An Ng <zhin@chromium.org> Cr-Commit-Position: refs/heads/master@{#68123}
-
Ng Zhi An authored
Bug: v8:10506 Change-Id: I896d0d614524bb9515593fb1fb2b1e3e9892a026 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2225938Reviewed-by:
-
- 02 Jun, 2020 9 commits
-
-
Ng Zhi An authored
Making them private was a way to hide the constructor, we can explicitly delete them, which give a better compilation error message as well. Also see: https://stackoverflow.com/q/55205874 Bug: v8:10488 Change-Id: I624efdb03edb4d1d07f95e756f2c87baba4b3ffe Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2223236Reviewed-by:
-
Ng Zhi An authored
See https://clang.llvm.org/extra/clang-tidy/checks/modernize-use-override.html for more on this warning. Bug: v8:10488 Change-Id: Icfb54d8f4ab0efe0fdf51bd1920511b7505207d0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2223234Reviewed-by:
-
Frank Tang authored
Implement the spec changes in https://github.com/tc39/ecma402/pull/430 Bug: v8:10554 Change-Id: I421d6feb94810027cf17ff58a4ec5357940ef44a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2212889Reviewed-by:
-
Clemens Backes authored
Since the interpreter cannot call out to JS any more, there cannot be more than one activation at a time. Hence remove the concept of activations. R=ahaas@chromium.org Bug: v8:10389 Change-Id: Ifda5624e192464a1aed2943787bc6860d1917719 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2219942Reviewed-by:
Andreas Haas <ahaas@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#68118}
-
Clemens Backes authored
This reverts commit 76debfda. Reason for revert: Nullptr access in new test: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux/37265 Original change's description: > [wasm-simd][liftoff] Fix I64x2Mul > > The I64x2Mul overwrote the lhs/rhs if they are the same as dst. So when > deciding if we need temporaries, we should not only check the > cache_state, but whether they alias dst or not. > > Bug: chromium:1088273 > Change-Id: I82efa9b45e0a3d321a06efde60971ce95b21490f > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2225796 > Commit-Queue: Zhi An Ng <zhin@chromium.org> > Reviewed-by: Clemens Backes <clemensb@chromium.org> > Cr-Commit-Position: refs/heads/master@{#68114} TBR=clemensb@chromium.org,zhin@chromium.org Change-Id: I5fd337b71d82d262d36ff410077a11c17b50036b No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: chromium:1088273 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2226756Reviewed-by:
-
Clemens Backes authored
In production, we will always pass a pointer to the decoded module. The only reason for the existance of the nullptr checks is that tests sometimes don't pass a module here. Hence we pay in production code for a test-only feature. This CL fixes this by always passing a module pointer from the decoder tests. This even simplifies the code a lot by removing redundant code. The {TestModuleBuilder} class was moved before the definitions of the {FunctionBodyDecoderTest} class in order to be able to reuse it there. It's unmodified otherwise. R=ahaas@chromium.org Bug: v8:10576 Change-Id: I7d876bfc8a27b50fe713afb8848fb4f642287cfa Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2226749Reviewed-by: -
Shu-yu Guo authored
This reverts commit c342ba82. Reason for revert: Incorrectly parsed destructuring + logical assignment Original change's description: > Set .name of anonymous functions on the RHS of logical assignment. > > https://github.com/tc39/proposal-logical-assignment/pull/24 reached > consensus in June TC39. > > Drive-by refactoring of testing for logical assignment ops using > IsInRange. > > Bug: v8:10579 > Change-Id: I5a203ba552a905cd28f75c5d223998431a1966ce > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2225809 > Reviewed-by: Marja Hölttä <marja@chromium.org> > Commit-Queue: Shu-yu Guo <syg@chromium.org> > Cr-Commit-Position: refs/heads/master@{#68101} TBR=marja@chromium.org,syg@chromium.org Change-Id: I7992941bb31ad063611a45a65d20517803910475 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:10579 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2227059Reviewed-by:
Shu-yu Guo <syg@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/master@{#68115}
-
Ng Zhi An authored
The I64x2Mul overwrote the lhs/rhs if they are the same as dst. So when deciding if we need temporaries, we should not only check the cache_state, but whether they alias dst or not. Bug: chromium:1088273 Change-Id: I82efa9b45e0a3d321a06efde60971ce95b21490f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2225796 Commit-Queue: Zhi An Ng <zhin@chromium.org> Reviewed-by:
-
Ng Zhi An authored
Making them private was a way to hide the constructor, we can explicitly delete them, which give a better compilation error message as well. Also see: https://stackoverflow.com/q/55205874 Bug: v8:10488 Change-Id: Ie9200b317e4d2f47b9e869701149960341878d3c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2223235Reviewed-by:
-
