- 12 Jul, 2019 7 commits
-
-
Georg Schmid authored
This CL adds the --assert-types flag to d8, which is intended to insert additional runtime checks after typed nodes, verifying the validity of our typing rules. So far, only range types are checked. Thanks to Neil Patil for suggesting something similar. R=neis@chromium.org, tebbi@chromium.org Change-Id: I5eb2c482235ec8cd07ee802ca7c12c86c2d3dc40 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1678372 Commit-Queue: Georg Schmid <gsps@google.com> Reviewed-by:
Georg Neis <neis@chromium.org> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#62664}
-
Frank Tang authored
https://chromium.googlesource.com/external/github.com/tc39/test262/+log/1ef21eb..6cb0a5 Bug: v8:7834 Change-Id: I809d7ddc0c579cf3fa8c9563d8f0ef59d4cc708b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1699302 Auto-Submit: Frank Tang <ftang@chromium.org> Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Commit-Queue: Frank Tang <ftang@chromium.org> Cr-Commit-Position: refs/heads/master@{#62663}
-
Michael Achenbach authored
NOTRY=true Bug: chromium:813833,chromium:983128 Change-Id: I449796b761f53bb15a3563604d5a4a9018035cb6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1697255Reviewed-by:
Tamer Tas <tmrts@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/master@{#62662}
-
Andreas Haas authored
Even though this is not spec'ed yet, it's good to have an implementation so that we can use clusterfuzz on it. I changed the parameter order (hopefully) everywhere to (table_dst_index, table_src_index, ...). This corresponds to the (dst, src, ...) parameter order for the entry indices. R=binji@chromium.org Bug: v8:7581 chromium:980475 Change-Id: I2fb36ffd4bb2f2be5b22c8366732295fa6759236 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1698386Reviewed-by:
Ben Smith <binji@chromium.org> Commit-Queue: Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/master@{#62661}
-
Jon Kunkee authored
This change fixes missing symbol errors in the Windows 10 on ARM build of Node.js. When a whole class is marked for export, all of its members are marked as well. This can be a problem when inline members call undefined yet inline members of other classes: the exported function will contain a reference to the undefined inline function that should be satisfied at link time, but because the other function is inline no symbol will be produced that will satisfy that reference. Clang gets around this by masking inlined class members from export using /Fc:dllexportInlines-. This is why b0a2a567 worked. Node.js' Windows builds use MSVC and so do not have access to this flag. This results in unresolved symbols at link time. Bug: v8:9465 Change-Id: Ief9c7ab6ba35d22f995939eb62a64d6f1992ed85 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1696771Reviewed-by:
Sigurd Schneider <sigurds@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#62660}
-
Yutaka Hirano authored
This is a reland of https://crrev.com/c/v8/v8/+/1692366. The original change was reverted because it broke some blink tests. This will be landed after suppressing them: https://crrev.com/c/chromium/src/+/1695541 Make native errors serializable. The implementation is mostly straightforward, but there is one exception: the stack property. Although the property is not specified, the spec for error cloning asks us to preserve the property if possible. This implementation serializes the property only when it is a string, and otherwise ignores it. Spec: https://github.com/whatwg/html/pull/4665 Intent-to-Ship: https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/f8JngIi8qYs Bug: chromium:970079, v8:9462 Change-Id: Ibf012754f30237f6b5acf119ef834e73727a230f Cq-Include-Trybots: luci.v8.try:v8_linux_blink_rel Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1695202 Auto-Submit: Yutaka Hirano <yhirano@chromium.org> Commit-Queue: Simon Zünd <szuend@chromium.org> Reviewed-by:
Simon Zünd <szuend@chromium.org> Cr-Commit-Position: refs/heads/master@{#62659}
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/40634f1..c989268 Rolling v8/buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/80b545b..95c72f3 Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/b79dda9..1abe66f Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/d3f6994..78dec04 Rolling v8/tools/luci-go: git_revision:25958d48e89e980e2a97daeddc977fb5e2e1fb8c..git_revision:7d11fd9e66407c49cb6c8546a2ae45ea993a240c Rolling v8/tools/luci-go: git_revision:25958d48e89e980e2a97daeddc977fb5e2e1fb8c..git_revision:7d11fd9e66407c49cb6c8546a2ae45ea993a240c Rolling v8/tools/luci-go: git_revision:25958d48e89e980e2a97daeddc977fb5e2e1fb8c..git_revision:7d11fd9e66407c49cb6c8546a2ae45ea993a240c TBR=machenbach@chromium.org,sergiyb@chromium.org,tmrts@chromium.org Change-Id: I014010e41a1fe31582ab5aa3abbb28b1f1be32f9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1698803Reviewed-by:
v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#62658}
-
- 11 Jul, 2019 33 commits
-
-
Ben Smith authored
The alignment should be 3 (i.e. 8 bytes), but was specified as 2 (i.e. 4 bytes). Bug: v8:9425 Change-Id: I0beb09df25fe0281ed604909e894afd804f5411e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1693836Reviewed-by:
Andreas Haas <ahaas@chromium.org> Commit-Queue: Ben Smith <binji@chromium.org> Cr-Commit-Position: refs/heads/master@{#62657}
-
Andreas Haas authored
Even though this is not spec'ed yet, it's good to have an implementation so that we can use clusterfuzz on it. R=binji@chromium.org Bug: v8:7581 Change-Id: I323625322e5240dc6ac224dce8a1f1f7f6070758 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1695478Reviewed-by:
-
Jakob Kummerow authored
Change-Id: Id474294a808f5c77321cd12ff5333eb6000b04fa Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1692933 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
-
Tobias Tebbi authored
This is a partial revert of https://chromium-review.googlesource.com/c/v8/v8/+/1675960 Bug: v8:9472 Change-Id: I57ffc8d90a57336197cbf6ee27ebf9d1c914ec73 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1697745 Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Tobias Tebbi <tebbi@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#62654}
-
Mythri A authored
With lazy feedback allocation and bytecode flushing we need to call %PrepareFunctionForOptimize before we call %OptimizeFunctionOnNextCall/ %OptimizeOsr. This cl: 1. Adds an additional state in pending optimized table to check if the optimization was triggered manually. 2. Changes the compilation pipeline to delete the entry from pending optimized table only if the optimization was triggered through %OptimizeFunctionOnNextCall / %OptimizeOsr. 3. Adds a check to enforce %PrepareFunctionForOptimize was called. 4. Adds a new run-time flag to only check in the d8 test runner. We don't want this check enabled in other cases like clusterfuzz that doesn't ensure %PrepareFunctionForOptimize is called. Bug: v8:8394, v8:8801, v8:9183 Change-Id: I9ae2b2da812e313c746b6df0b2da864c2ed5de51 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1664810 Commit-Queue: Mythri Alle <mythria@chromium.org> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#62653}
-
Maciej Goszczycki authored
BasicMemoryChunk sits above the MemoryChunk in the chunk hierarchy and is responsible for storing the bare minimum data to identify a chunk of memory, without worrying about GC etc. This change also completes the MemoryChunk offset asserts, which were previously missing for few key properties. Bug: v8:7464 Change-Id: Id4c7716c4ed5722ceca3cbc66d668aed016c74b0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1688843 Commit-Queue: Maciej Goszczycki <goszczycki@google.com> Reviewed-by:
-
Jakob Kummerow authored
Change-Id: Id1c46ca22002c358155823e3caae18f0ed9c47f5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1691033 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
-
Peter Marshall authored
The simulator builds have bugs which cause invalid frame markers in some cases. Change-Id: I837732c6f5efe24821415a0ae0626578bbcc3a7e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1697253Reviewed-by:
-
Mythri A authored
GetOwnPropertyNameTryFast uses ENUMERABLE_STRINGS filter to trigger fast path in KeyAccumulator::GetKeys conditionally when all properties on the receiver are enumerable. It is not easy to verify if all properties are enumerable and the current check is incorrect in some cases. For ex: when we have non-enumerable properties when we have elements on the receiver. This cl removes this try_fast path from the builtin. This could impact performance. The long term fix for this would be to fix KeyAccumulator::GetKeys to use fast path for more cases. Bug: chromium:977870 Change-Id: Iecde730739c2c452ffa0d893d0d1b3612a45d1b2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1679499Reviewed-by:
Igor Sheludko <ishell@chromium.org> Commit-Queue: Mythri Alle <mythria@chromium.org> Cr-Commit-Position: refs/heads/master@{#62649}
-
Andreas Haas authored
R=mstarzinger@chromium.org Bug: v8:7581 Change-Id: I9db3d2e4b2e2a685f81b516da8e6737db01c1238 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1695470 Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#62648}
-
Maciej Goszczycki authored
These are ancient artefacts from when HeapObject was a pointer. Bug: v8:9396 Change-Id: I1782837aa5bd4b8393cd084321b90baa614a7373 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1691911Reviewed-by:
-
Michael Achenbach authored
In order to migrate the extra flags into the fuzzer and keep bisection stable, we need to use the same RNG state for each call to generating fuzz flags. Throughout one fuzzing session the same random-seed is used (https://crbug.com/983128) and we'll pass it to the fuzz config in a follow up. TBR=tmrts@chromium.org NOTRY=true Bug: chromium:813833 Change-Id: I3203c86028a5d283238e6ef739f82eccee1302b1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1697254 Commit-Queue: Michael Achenbach <machenbach@chromium.org> Reviewed-by:
-
Santiago Aboy Solanes authored
Reverse specialization of https://chromium-review.googlesource.com/c/v8/v8/+/1684075. Again, it skips over Tagged to save some instructions. Cq-Include-Trybots: luci.v8.try:v8_linux64_pointer_compression_rel_ng Cq-Include-Trybots: luci.v8.try:v8_linux64_arm64_pointer_compression_rel_ng Bug: v8:7703 Change-Id: I7fc50e0d8eebfef7a1ba02ce3d687ff808f30680 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1693007Reviewed-by:
-
Ben L. Titzer authored
In the atomics stress, the search for sequential sequences creates lots of new WebAssembly.Memory objects. This memory pressure is not central to this test, so reuse the same memory to make them less flaky. R=mstarzinger@chromium.org Change-Id: I8d135e7b82d572cb1df38f37a4e2f6393f6b2e05 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1697247Reviewed-by:
-
Andreas Haas authored
This removes an include that was added unnecessarily in https://crrev.com/c/1690960. R=clemensh@chromium.org Bug: v8:9396 Change-Id: I5cf7ae49b3a40b6665605af1db6b43b27aeb3a32 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1692927Reviewed-by:
Clemens Hammacher <clemensh@chromium.org> Commit-Queue: Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/master@{#62643}
-
Michael Starzinger authored
R=clemensh@chromium.org BUG=v8:9429,v8:9396 Change-Id: I3b098ea8b5bbbd93ac3bf7acfeb8ee20a867759a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1693004Reviewed-by:
-
Michael Starzinger authored
This adds support for properly importing {WebAssembly.Function} objects that were constructed in JavaScript and just wrap a JavaScript callable. R=ahaas@chromium.org TEST=mjsunit/wasm/type-reflection BUG=v8:7742 Change-Id: I00e01db0d85b83d405eb28517d00fba62c253985 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1690949 Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by: -
Frank Tang authored
https: //chromium.googlesource.com/external/github.com/tc39/test262/+log/079b00..1ef21eb Bug: v8:7834 Change-Id: I0c6b42c4bd13839138cf333a311bdd5404dc4496 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687062Reviewed-by:
Mathias Bynens <mathias@chromium.org> Reviewed-by:
-
Jakob Kummerow authored
Change-Id: I871659626b41a15723f92150f6f076d356313136 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1691028 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
-
Georg Neis authored
This reverts commit a6eabacf. Reason for revert: as planned Original change's description: > Disabe FLAG_turbo_control_flow_aware_allocation again > > A few changes have been made to this feature and disabling it lets us > best see its current performance impact. > > Bug: v8:9088 > Change-Id: I54d5e09f3fcece215e29d66d5bdb3f19ba07bda0 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1690954 > Reviewed-by: Sigurd Schneider <sigurds@chromium.org> > Commit-Queue: Sigurd Schneider <sigurds@chromium.org> > Cr-Commit-Position: refs/heads/master@{#62586} TBR=neis@chromium.org,sigurds@chromium.org # Not skipping CQ checks because original CL landed > 1 day ago. Bug: v8:9088 Change-Id: I13b94d90cfb2d8e9372291645729e05b79a9a6ea Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1697243Reviewed-by:
-
Darius Mercadier authored
Change-Id: Ic483412145cabd2fce8f556fd56ca352dbe4ce17 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1695466Reviewed-by:
-
Lei Zhang authored
In a DCHECK inside AddExport(), MSVC gives a C4018 signed/unsigned mismatch warning. Use a cast to silence this. Change-Id: Ie388b95b183d2ca3649475fe2206171800673f88 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1697043 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Auto-Submit: Lei Zhang <thestig@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
-
Darius Mercadier authored
Bug: v8:9329 Change-Id: I28619fef8f206fcb749b8974bb3e7547d6da402e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687423 Commit-Queue: Darius Mercadier <dmercadier@google.com> Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
-
Peter Marshall authored
Add a bit on the isolate which indicates that the stack is currently not iterable for the SafeStackFrameIterator. This is needed during deoptimization, when we do a fast C call without a return address on the stack, meaning we can't iterate the stack frames. Re-enable DeoptAtFirstLevelInlinedSource which is fixed by this CL. Bug: v8:9057 Change-Id: I76379a2dd38023be7e6f5153edeb1f838e9ac4d6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1688049 Commit-Queue: Peter Marshall <petermarshall@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
-
Clemens Hammacher authored
This removes the last remaining use of the AbortJS opcode. We now use AbortCSAAssert instead, which is not influenced by the --disable-abortjs flag. The AbortJS runtime function should only be called from JS now. R=mstarzinger@chromium.org Bug: v8:9396 Change-Id: I791da99594f9e1e99991ac8b03e943297d7d41e3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1695476 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
Yang Guo <yangguo@chromium.org> Cr-Commit-Position: refs/heads/master@{#62633}
-
Michael Starzinger authored
This fixes a corner-case where a {WasmExportedFunction} that represents a re-export of a JavaScript callable from another module was identified correctly, but not all corner-cases were correctly covered. Concretely we failed to check for function signatures incompatible with JavaScript. R=ahaas@chromium.org TEST=mjsunit/regress/wasm/regress-9447 BUG=v8:9447 Change-Id: Ia6c73c82f4c1b9c357c08cde039be6af100727d6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1690941 Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by: -
Jakob Gruber authored
Prior to this CL, it was possible to pollute another context's fast/slow-path state for RegExp builtins due to the species protector being per-isolate rather than per-context. Among other things, this means that iframes can slow down the main site, and slowdowns persist across page reloads and navigation within the same tab. This CL thus moves the RegExpSpeciesProtector to the native context. The same should be done for all other protectors in the future. Bug: chromium:977382, v8:5577, v8:9463 Change-Id: I577f470229cb9dfcd4a88c20b1b9111c65a9b85f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1695465 Auto-Submit: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
-
Dan Elphick authored
This reverts commit e8d86597. Reason for revert: crbug.com/981701 Original change's description: > [parsing] Improve elision of hole checks for default parameters > > Use the position of the next parameter to be declared as the end of the > initializer for default parameters, so that hole checks can be elided > for initializers using previous parameters in arrow functions. > > This fixes a source of bytecode mismatches when collecting source > positions lazily. > > Bug: chromium:980422, v8:8510 > Change-Id: I5ab074231248b661156e7d8e47c01685448b56d5 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1683267 > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Commit-Queue: Dan Elphick <delphick@chromium.org> > Cr-Commit-Position: refs/heads/master@{#62525} TBR=verwaest@chromium.org,delphick@chromium.org # Not skipping CQ checks because original CL landed > 1 day ago. Bug: chromium:980422, v8:8510 Change-Id: I3abd70a1fb00967e58b46177655a0078e24db720 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1697242Reviewed-by:
Dan Elphick <delphick@chromium.org> Commit-Queue: Dan Elphick <delphick@chromium.org> Cr-Commit-Position: refs/heads/master@{#62630}
-
Jakob Kummerow authored
Change-Id: I7bce20f1f8b0a2ca2fe86cd65905e9ea65134e27 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1691027 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
-
Peter Marshall authored
We don't use this anywhere, it's always true. Change-Id: Iae16a108f036de5eddd1b9741e554ddd4eac8c83 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1692928 Commit-Queue: Peter Marshall <petermarshall@chromium.org> Reviewed-by:
-
Andreas Haas authored
At the moment we cancel all {AsyncCompileJobs} when a context of an isolate gets disposed. However, there can be multiple contexts per isolate, which meant that in some cases we canceled compilations even though their context was still alive. With this CL we only abort the compilations of the native context, which is typically the context that is being disposed. This is a small change that can be merged back. I plan to do a proper change later which extends the V8 API so that the embedder provides a handle to the context that is disposed. R=clemensh@chromium.org Bug: chromium:980876 Change-Id: I278bc30f084fe31fa409f1d4f913f1186b4809ec Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1692939 Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by: -
Clemens Hammacher authored
The {FrameScope} with {StackFrame::NONE} just sets the {has_frame_} field in the {TurboAssembler}, so it's fine to just unconditionally do that. The field will be reverted to the previous state when the {FrameScope} dies. R=mstarzinger@chromium.org Bug: v8:9396 Change-Id: Iec56a9bd45d19eda689ff033df58928d6edbdcf0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1692930 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by: -
Clemens Hammacher authored
R=ahaas@chromium.org Bug: v8:9429, v8:9396 Change-Id: If26b9a480261c1625b6844b05de5323648ab34b6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687544Reviewed-by:
-
