- 14 Jan, 2020 16 commits
-
-
Michael Lippautz authored
- Introduces a API to set top of the stack through EmbedderHeapTracer::SetStackTop. - Introduces a new API to inform V8 about an empty embedder stack. - Switch internal representation of TracedReference for on-stack handles to a proper stack that considers all contained handles as roots. - Handle garbage is avoided by cleaning up on handle creation or GC. Design doc: https://bit.ly/on-stack-traced-reference Bug: chromium:1040038 Change-Id: I927ef0abb268fdb5853c9e17b1bc96e2491cf101 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1993973 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/master@{#65757}
-
Seth Brenith authored
There is no particular reason that PropertyDescriptorObject should be a subclass of FixedArray. By using a separate struct type, we get better generated accessor functions, automatic verification, and runtime type info, plus we save four bytes per instance. Change-Id: If076782832aa9398806794e4ee6d019aea2f92b7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1999463Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Seth Brenith <seth.brenith@microsoft.com> Cr-Commit-Position: refs/heads/master@{#65756}
-
Ulan Degenbaev authored
Currently the on-hold area is reset on incremental marking steps. At the start of marking we conservatively assume that the on-hold area spans the initially allocated linear allocation area, which may be large. Bug: chromium:973627 Change-Id: I83f2d0e38a2a255c1e8d48549352e9303be89920 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2000737Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#65755}
-
Leszek Swirski authored
The fix in https://crrev.com/c/1997135 didn't properly recurse the cache scope after a with scope, passing the current scope rather than the original cache scope up the recursion. Now the "use external cache" check is done in LookupWith (and, analogously, LookupSloppyEval) while passing the given cache scope through the Lookup recursion. Fixed: chromium:1041210 Fixed: chromium:1041616 Change-Id: I5ac9ddc6c16d63b59aa034721fccec2f7781c4f8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2000133 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/master@{#65754}
-
Clemens Backes authored
Just a cleanup to remove an unused enum marker. R=ahaas@chromium.org Change-Id: I7b40f2389796f43d82d06eb161569ecea7892ef6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2000145Reviewed-by:
Andreas Haas <ahaas@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#65753}
-
Michael Lippautz authored
Change-Id: I5889da6b5bb916639d00c450d06c35040c34a9a0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1997130 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
-
Clemens Backes authored
This fixes local names that are the string representation of a valid element index. Even though both the Liftoff and the interpreter-based test are changed, only the latter needs to be fixed right now since Liftoff does not use the names currently. Modifying the test just ensures that we implement this correctly once we use the name. R=jkummerow@chromium.org Bug: v8:10019 Change-Id: Ib7f7d6e244a344a85ab540b6c2c67f98b1f3078e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1998079 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#65751}
-
Jakob Kummerow authored
TSan complains in "isolates" tests otherwise. Also further reduce virtual memory requirements of the sample test to address flaky allocation failures on 32-bit platforms. Change-Id: I26c9a59965009d7083876b4ff4836ee879d33350 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2000138 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#65750}
-
Clemens Backes authored
This saves the addition when accessing the stack slot, and (more importantly) will make it easier to access the stack slot for debugging, since there is no platform-specific constant to be added any more. R=zhin@chromium.org Bug: v8:10019 Change-Id: I3eaf1838b78c2b7b343a435d7c8a32e7e71508ed Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1998082Reviewed-by:
Zhi An Ng <zhin@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#65749}
-
Georg Neis authored
It was missing the name field. Bug: chromium:1036641 Change-Id: I686a46adfccfd656422cddef340ded58b7a9c9b1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2000135 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
-
Maya Lekova authored
This reverts commit 304e97d3. Reason for revert: Last roll is failing - https://ci.chromium.org/p/chromium/builders/try/linux-rel/282356 Original change's description: > [parser] Fix caching dynamic vars on wrong scope > > When looking up a variable in a deserialized WITH scope, we were > unconditionally passing in the cache scope to the lookup, even if the > with was inside the cache scope. This would lead to and outer scope of > the with holding the generated dynamic variable. If the cache scope was > the SCRIPT scope, the dynamic variable would be interpreted as a global > object property. > > Now, we only store the WITH scope dynamic variables in the cache scope > if it is an inner scope of the WITH scope, same as we do for 'normal' > scope lookups. > > Fixed: chromium:1041210 > Change-Id: I4e8eb25bbb8ea58311355d13a9c7c97bf2fa3ec7 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1997135 > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Commit-Queue: Toon Verwaest <verwaest@chromium.org> > Auto-Submit: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/master@{#65732} TBR=leszeks@chromium.org,verwaest@chromium.org Change-Id: I7b6d77d03b603152a9a47541db466934f46b1176 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2000140Reviewed-by:
Maya Lekova <mslekova@chromium.org> Commit-Queue: Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/master@{#65747}
-
Simon Zünd authored
This CL fixes a negative capacity check up the call-chain to fix an issue found a clusterfuzz. This is temporary since mid-term we want to change the interface of allocation functions to take an unsigned C++ type, so implicit conversion errors like this one, can't happen. Fixed: chromium:1041240 Change-Id: Ib344e5738d2648fbf9a2951ca943ff566ddd5f09 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2000134Reviewed-by:
-
Dominik Inführ authored
Removing this caused performance regressions. Bug: chromium:1036514 Change-Id: If24826874c45c21670a59f9dbbe57dacd44ae5fc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1998080Reviewed-by:
-
v8-ci-autoroll-builder authored
Rolling v8/buildtools/linux64: git_revision:a5bcbd726ac7bd342ca6ee3e3a006478fd1f00b5..git_revision:0c5557d173ce217cea095086a9c9610068123503 Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/7a8bf94..a1266b6 TBR=machenbach@chromium.org,tmrts@chromium.org Change-Id: Id7d531f24a9f1becd4c0d03fc09d747c2d1a9dda Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1999804Reviewed-by:
v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#65744}
-
Zhou, Zhiguo authored
This CL implements 4 of the 6 load extend operations. The added opcodes include: I16x8Load8x8S, I16x8Load8x8U, I32x4Load16x4S, I32x4Load16x4U. Bug: v8:9886 Change-Id: I9961f97325168e3a0036e1b282b769cc65b06ffb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1981329 Commit-Queue: Zhiguo Zhou <zhiguo.zhou@intel.com> Reviewed-by:
Deepti Gandluri <gdeepti@chromium.org> Reviewed-by:
-
Deepti Gandluri authored
The UpdateSharedWasmMemoryObjects function only creates a new JSArrayBuffer when the the legths of old/new ArrayBuffer objects are unequal, but the CHECK in the Grow() funciton assumes that a new object is always created. Fix so that a new ArrayBuffer is always allocated. Bug: v8:10044, chromium:1040325 Change-Id: I66912bdc091e65a57e5b50f4ed63b0da5492dcc4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1999603Reviewed-by:
Ben Smith <binji@chromium.org> Commit-Queue: Deepti Gandluri <gdeepti@chromium.org> Cr-Commit-Position: refs/heads/master@{#65742}
-
- 13 Jan, 2020 24 commits
-
-
Jakob Kummerow authored
Rather than explicitly requesting MAP_HUGETLB mappings, which requires kernel configuration, we should rely on the "Transparent Hugepages" feature, where eligible allocation requests are automatically fulfilled with huge page mappings. Bug: chromium:1041232 Change-Id: I5263da7a23290316aa7b99e63881ca88e65b4e34 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1997442 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
-
Clemens Backes authored
To follow the style guide, and potentially improve performance, we switch to {int} for all stack offsets. The size of the stack cannot grow anywhere near {kMaxInt} anyway, and we have limits in place (for number of locals, number of parameters, and function body size) which also prevent this number from ever growing near that limit. R=jkummerow@chromium.org Change-Id: I05ca9124d2def79edd212464739bc12315f7b813 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1997445Reviewed-by: -
Ng Zhi An authored
Bug: v8:10082 Change-Id: I68e540c5b68c62fd6d43075e5244a9794d6d3eda Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1980908 Commit-Queue: Zhi An Ng <zhin@chromium.org> Reviewed-by:
-
Ng Zhi An authored
Note the tricky part in instruction-selector-x64, where we flip the inputs given to the code generator. This is because the semantics we want is: v128.andnot a b = a & !b, but the x64 instruction performs andnps a b = !a & b. Therefore we flip the inputs, and combined with g.DefineSameAsFirst, the output register will be the same as b, and we can use andnps without any modifications in both SSE and AVX cases. Bug: v8:10082 Change-Id: Iff98dc1dd944fbc642875f6306c6633d5d646615 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1980894Reviewed-by:
-
Mythri A authored
For measuring the time spent in each phase of TurboFan we use PipelineRunScope that adds a RuntimeCallStats scope with the correct counter. PipelineRunScope uses the runtimestats table set on the PipelineData to initialize the RuntimeCallStats scope. We correctly set the runtimestats on the pipelineData when starting ExecuteJobs but don't set it on PrepareJobs. This cl fixes it to also set runtimestats table on PrepareJobs. PrepareJobs always run on main thread, so it should be safe to use the runtimestats table on the isolate. Change-Id: Ied211158a10197aabb94373967146089a48c2db0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1995386 Commit-Queue: Mythri Alle <mythria@chromium.org> Reviewed-by:
Dan Elphick <delphick@chromium.org> Reviewed-by:
-
Ulan Degenbaev authored
This adds inference for general JSObjects to NativeContextInferrer in the case when the object is going to be attributed to the shard context. Bug: chromium:973627 Change-Id: I393e8dd16a1f8b615fb2f8dceb52f543bae33554 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1997133Reviewed-by:
-
Santiago Aboy Solanes authored
TNodified: * LoadValueByKeyIndex * LoadPropertyFromGlobalDictionary * LoadDetailsByKeyIndex Bug: v8:10021 Change-Id: Ie992982d0b03962658f4ef30351f1f84e8ce027e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1995394Reviewed-by:
Mythri Alle <mythria@chromium.org> Reviewed-by:
-
Pierre Langlois authored
Simulator-specific instructions are very useful, we can: - Place breakpoints that enable the simulator's interactive debugger, allowing us to see registers, the stack and print JS objects. - Enable and disable simulator tracing dynamically. - Call printf() directly, as the simulator cannot easily support its calling convention. However these tools are not available when generating builtins. The reason is that when cross-compiling, builtins are generated for real hardware but may still run inside the simulator on the host if we have a custom snapshot. Using the `v8_embed_script` GN option will do that for example but embedders may also do this with the V8 API. mksnapshot cannot tell the difference between generating code for a simulator build and a cross-build. If we change this, we can allow us to use simulator-specific features in builtins in simulator builds. So in this patch we: - Introduce a --target_is_simulator mksnapshot flag to drive the enable_simulator_code Assembler option. - Make sure the assembler respect the option instead of the USE_SIMULATOR macro. Change-Id: I7a7249f514427c1a2518a1af3679679596a72c7e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1991497Reviewed-by:Jakob Gruber <jgruber@chromium.org> Commit-Queue: Pierre Langlois <pierre.langlois@arm.com> Cr-Commit-Position: refs/heads/master@{#65734}
-
Santiago Aboy Solanes authored
TNodified: * StoreObjectField * StoreObjectFieldNoWriteBarrier Bug: v8:10021 Change-Id: I74b34af410c560a1b005c0b93c71468ef57087fe Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1993296 Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
-
Leszek Swirski authored
When looking up a variable in a deserialized WITH scope, we were unconditionally passing in the cache scope to the lookup, even if the with was inside the cache scope. This would lead to and outer scope of the with holding the generated dynamic variable. If the cache scope was the SCRIPT scope, the dynamic variable would be interpreted as a global object property. Now, we only store the WITH scope dynamic variables in the cache scope if it is an inner scope of the WITH scope, same as we do for 'normal' scope lookups. Fixed: chromium:1041210 Change-Id: I4e8eb25bbb8ea58311355d13a9c7c97bf2fa3ec7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1997135Reviewed-by:
-
Santiago Aboy Solanes authored
Bug: v8:10021 Change-Id: I2e27fbc52f9a42f1e52733e46a41227fbcaa8874 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1995393Reviewed-by:
-
Santiago Aboy Solanes authored
Bug: v8:10021 Change-Id: I78948e93ca61116a6a1a45ccbc1dfa7c27988c30 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1995391Reviewed-by:
-
Ross McIlroy authored
BUG=v8:10021 Change-Id: Ife3bdb70968c90813ea96e3eaacaa78712ba5540 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1995396 Auto-Submit: Ross McIlroy <rmcilroy@chromium.org> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Reviewed-by:
Santiago Aboy Solanes <solanes@chromium.org> Cr-Commit-Position: refs/heads/master@{#65729}
-
Toon Verwaest authored
Change-Id: I34aff1cef476a1237e59e8151b82bdb09819664f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1997126 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/master@{#65728}
-
Sigurd Schneider authored
The time was reported in milliseconds, but should be reported in seconds instead. TBR=ulan@chromium.org, szuend@chromium.org Change-Id: I171cdb0107cd522b0d62ac6ed4edfacf7599da0b Bug: chromium:1022031 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1997137Reviewed-by:
Sigurd Schneider <sigurds@chromium.org> Reviewed-by:
Simon Zünd <szuend@chromium.org> Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#65727}
-
Milad Farazmand authored
Due to the changes introduced int this CL: https://chromium-review.googlesource.com/c/v8/v8/+/1991498 wasm-scope-info-liftoff needs to be skipped until lifoff is enabled. Details can be found in the comment section of the above link. Change-Id: I1f61d1685a6ec2e81dab84b003f984a706d45737 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1993906Reviewed-by:
-
Toon Verwaest authored
This makes the code a little more specific to what's happening: There is only 1 global scope, and if there is one, we know its declarations are info->scope()->declarations(). That means we don't need multiple GlobalDeclarationsBuilders, and we don't need to cache partially serialized versions of the declarations. One builder is enough, and we can simply walk those declarations if there are any. Additionally this CL drops unnecessary information passed into DeclareGlobals: - Global functions always have the name on the shared function info, so we can drop the name. - Due to lazy feedback vectors there's no point in trying to preinitialize global loads. Also this was only preinitializing global loads at the script level, not sub functions; without even checking whether the global load was used. It may actually have caused us to do more work and allocate more global load feedback slots than neccessary. Change-Id: Ibbdd029abe5a39ba27f7fc9be84670c5d444d98d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1997123 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Reviewed-by:
-
Dominik Inführ authored
This CL adds the ArrayBufferExtension class, which is used to track JSArrayBuffers in a linked list. The ArrayBufferExtension is going to replace the ArrayBufferTracker in the future but is currently behind the v8_enable_array_buffer_extension feature flag. When enabled, each JSArrayBuffer has a corresponding native-heap allocated ArrayBufferExtension object. All extensions are currently tracked in a single linked list. During marking the GC not only marks the JSArrayBuffer but also its extension object. At the end of mark-compact the GC iterates all extensions and removes unmarked ones. Change-Id: I88298be255944d5ae1327c91b0d7f0fdbcd486d5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1969791Reviewed-by:
Peter Marshall <petermarshall@chromium.org> Reviewed-by:
-
Clemens Backes authored
This brings the test back in sync with the wasm-scope-info-liftoff test after the comments on https://crrev.com/c/1975754. R=jkummerow@chromium.org Bug: v8:10021 Change-Id: I8e3751fdb11fb32a0112c0706559a6d26e2e7594 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1977860Reviewed-by:
-
Tobias Tebbi authored
This is an improved version of https://chromium-review.googlesource.com/c/v8/v8/+/1981507 Bug: chromium:1031909 Change-Id: I552f49bf87340eee3c85fa02893b8e63a77a3608 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1997129Reviewed-by:
Georg Neis <neis@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#65722}
-
Simon Zünd authored
After the V8 internal stack frame cache was removed in https://crrev.com/c/1954392, the frames in stack traces will always have unique frame IDs. This renders the inspector side frame cache obsolete and this CL removes that cache. Change-Id: Icb72eec396e96b378ace09bc20fda03b09998c64 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1997127 Auto-Submit: Simon Zünd <szuend@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Simon Zünd <szuend@chromium.org> Cr-Commit-Position: refs/heads/master@{#65721}
-
Jakob Kummerow authored
Bug: v8:10120 Change-Id: Ida81a4a4806bd2b4c19432412144b5e6f9c896e9 No-Try: true Tbr: clemensb@chromium.org Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1997134Reviewed-by:
-
legendecas authored
Fixed: v8:10083 Change-Id: I50e01022b1d1219ad8b31dd71f58f5bc9c9d10bb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1987845 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Reviewed-by:
-
Jakob Kummerow authored
This patch contains real changes affecting the following tests: - regress-1119: Bogus test, was failing justifiedly. Dropped. - regress-crbug-9161: Was accidentally disabled everywhere. Re-enabled for ASan (as the comment promised). - regress-crbug-160010: Throws "invalid string length" on all platforms. Was disabled everywhere. Dropped. - regress-crbug-514081: Test was previously changed to use 2MB instead of 2GB. Re-enabled variants. Additionally, it reorders a bunch of definitions: - Introduced separate sections for "mode == debug" and "no_i18n" to make the "ALWAYS" section cleaner. - Sorted various "slow tests", "open bugs", and "no_variants" definitions into groups. - Simplified long "arch == x or arch == y" sequences to "arch in (x, y)". Bug: v8:10021 Change-Id: Ibe404ae400011196473cf082a4706ddbef7c8349 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1995390Reviewed-by:Michael Achenbach <machenbach@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#65718}
-
