- 17 May, 2016 1 commit
-
-
bmeurer authored
This adds back the instanceof operator support in the backends and introduces a @@hasInstance protector cell on the isolate that guards the fast path for the InstanceOfStub. This way we recover the ~10% regression on Octane EarleyBoyer in Crankshaft and greatly improve TurboFan and Ignition performance of instanceof. R=ishell@chromium.org TBR=hpayer@chromium.org,rossberg@chromium.org BUG=chromium:597249, v8:4447 LOG=n Review-Url: https://codereview.chromium.org/1980483003 Cr-Commit-Position: refs/heads/master@{#36275}
-
- 13 May, 2016 1 commit
-
-
verwaest authored
Hidden prototypes are merely an implementation detail. Properties on an object + hidden prototype should look like properties on the object. Hence we should always perform a hidden prototype lookup. This CL removes the option to ignore hidden prototypes to avoid bugs that leak this implementation detail. Also, the only previously valid cases were either places were we knew we didn't have a hidden prototype; or because we knew we (in the optimizing compiler) would only handle properties from the non-hidden object.The first case is already handled by directly tagging whether a receiver has a hidden prototype. In the second case we can just filter out properties from hidden prototypes. Review-Url: https://codereview.chromium.org/1975763002 Cr-Commit-Position: refs/heads/master@{#36235}
-
- 12 May, 2016 1 commit
-
-
cbruni authored
Currently we do not check for @@isConcatSpreadable properly. If the Symbol is set on the Array.prototype or Object.prototype the current fast paths fail. This CL adds a fix to globally invalidate a isConcatSpreadable_protector. Drive-by-fix: use named accessors for context variables LOG=N BUG=chromium:542504, v8:903 Review-Url: https://codereview.chromium.org/1409123003 Cr-Commit-Position: refs/heads/master@{#36201}
-
- 04 May, 2016 1 commit
-
-
jochen authored
BUG=chromium:588893, chromium:325923 LOG=n R=verwaest@chromium.org Review-Url: https://codereview.chromium.org/1943303002 Cr-Commit-Position: refs/heads/master@{#36025}
-
- 09 Mar, 2016 1 commit
-
-
verwaest authored
BUG= Review URL: https://codereview.chromium.org/1776803003 Cr-Commit-Position: refs/heads/master@{#34628}
-
- 07 Mar, 2016 1 commit
-
-
verwaest authored
BUG=chromium:592305 LOG=n Review URL: https://codereview.chromium.org/1770833002 Cr-Commit-Position: refs/heads/master@{#34552}
-
- 04 Mar, 2016 1 commit
-
-
verwaest authored
BUG= Review URL: https://codereview.chromium.org/1765713003 Cr-Commit-Position: refs/heads/master@{#34492}
-
- 03 Mar, 2016 1 commit
-
-
machenbach authored
This reverts commit 2608ecc7. Revert "Specialize helper methods in the LookupIterator by is_element." This reverts commit 6eb483f8. Revert "Avoid SetPropertyInternal if the LookupIterator is NotFound" This reverts commit ca5bd8d4. Revert "Inline fast-bailout-checks for LookupIterator::UpdateProtector" This reverts commit d98570a1. This breaks layout tests with timeouts: https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/5060 It also seems to break jsfunfuzz: https://build.chromium.org/p/client.v8/builders/V8%20Fuzzer/builds/7930 The other three CLs are reverted to be able to revert the first. BUG=v8:4798 LOG=n TBR=verwaest@chromium.org Review URL: https://codereview.chromium.org/1761593003 Cr-Commit-Position: refs/heads/master@{#34457}
-
- 02 Mar, 2016 3 commits
-
-
verwaest authored
BUG= Review URL: https://codereview.chromium.org/1754023003 Cr-Commit-Position: refs/heads/master@{#34438}
-
verwaest authored
This speeds up lookup. BUG= Review URL: https://codereview.chromium.org/1753273002 Cr-Commit-Position: refs/heads/master@{#34430}
-
verwaest authored
This introduces a new instance type and reorders the JSObject types so any type requiring special LookupIterator support can be identified with a single range check. In addition, it restructures the Next for better performance, avoiding unnecessary calls. BUG= Review URL: https://codereview.chromium.org/1751043002 Cr-Commit-Position: refs/heads/master@{#34429}
-
- 22 Feb, 2016 1 commit
-
-
littledan authored
This patch makes ArraySpeciesCreate fast in V8 by avoiding two property reads when the following conditions are met: - No Array instance has had its __proto__ reset - No Array instance has had a constructor property defined - Array.prototype has not had its constructor changed - Array[Symbol.species] has not been reset For subclasses of Array, or for conditions where one of these assumptions is violated, the full lookup of species is done according to the ArraySpeciesCreate algorithm. Although this is a "performance cliff", it does not come up in the expected typical use case of @@species (Array subclassing), so it is hoped that this can form a good start. Array subclasses will incur the slowness of looking up @@species, but their use won't slow down invocations of, for example, Array.prototype.slice on Array base class instances. Possible future optimizations: - For the fallback case where the assumptions don't hold, optimize the two property lookups. - For Array.prototype.slice and Array.prototype.splice, even if the full lookup of @@species needs to take place, we still could take the rest of the C++ fastpath. However, to do this correctly requires changing the calling convention from C++ to JS to pass the @@species out, so it is not attempted in this patch. With this patch, microbenchmarks of Array.prototype.slice do not suffer a noticeable performance regression, unlike their previous 2.5x penalty. TBR=hpayer@chromium.org Review URL: https://codereview.chromium.org/1689733002 Cr-Commit-Position: refs/heads/master@{#34199}
-
- 19 Feb, 2016 1 commit
-
-
verwaest authored
This should restore the splay regression. BUG= Review URL: https://codereview.chromium.org/1714753003 Cr-Commit-Position: refs/heads/master@{#34144}
-
- 18 Feb, 2016 1 commit
-
-
verwaest authored
BUG= Review URL: https://codereview.chromium.org/1704353002 Cr-Commit-Position: refs/heads/master@{#34118}
-
- 17 Feb, 2016 2 commits
-
-
verwaest authored
BUG= Review URL: https://codereview.chromium.org/1705713002 Cr-Commit-Position: refs/heads/master@{#34070}
-
verwaest authored
BUG= Review URL: https://codereview.chromium.org/1702623002 Cr-Commit-Position: refs/heads/master@{#34063}
-
- 16 Feb, 2016 1 commit
-
-
verwaest authored
BUG= Review URL: https://codereview.chromium.org/1702443002 Cr-Commit-Position: refs/heads/master@{#34024}
-
- 15 Feb, 2016 1 commit
-
-
verwaest authored
By not calling ReloadPropertyInformation, we avoid expensive descriptor array lookup. BUG= Review URL: https://codereview.chromium.org/1697153002 Cr-Commit-Position: refs/heads/master@{#33995}
-
- 11 Feb, 2016 1 commit
-
-
verwaest authored
In the case of a simple fast-mode receiver without fancy properties, we can just walk over the descriptor array to find all its initial property names. As long as the map stays the same, we can also use that descriptor array to figure out how to handle the properties. This speeds up https://github.com/kpdecker/six-speed/tree/master/tests/object-assign by ~2x. BUG= Review URL: https://codereview.chromium.org/1688953004 Cr-Commit-Position: refs/heads/master@{#33895}
-
- 03 Feb, 2016 1 commit
-
-
verwaest authored
This was inconsistent in the spec in case of has vs get, set. Removing receiver==holder simplifies the lookup; so tentatively removing this additional check which was broken until yesterday anyway. See https://github.com/tc39/ecma262/issues/347 for more information. Review URL: https://codereview.chromium.org/1660903002 Cr-Commit-Position: refs/heads/master@{#33701}
-
- 02 Feb, 2016 1 commit
-
-
verwaest authored
This includes 2 fixes: 1) We didn't properly advance the holder when checking whether Receiver==Holder, so we'd inadvertently block loading the property if the first property we find is on the typed array. 2) Reflect.get may cause any object on the prototype chain of the holder to be the receiver; so we need to recheck for this special state for each object we perform lookup on. Review URL: https://codereview.chromium.org/1651913005 Cr-Commit-Position: refs/heads/master@{#33689}
-
- 27 Jan, 2016 1 commit
-
-
verwaest authored
BUG=chromium:580584 LOG=y Review URL: https://codereview.chromium.org/1632603002 Cr-Commit-Position: refs/heads/master@{#33551}
-
- 26 Jan, 2016 1 commit
-
-
jarin authored
This replace HeapType with a dedicated class that implements just what we need for field type tracking. In the next CL, I plan to remove FieldType::Iterator because FieldType can iterate over at most one map. The ultimate plan is to get rid of templates in types.(h|cc) and remove type-inl.h. TBR=rossberg@chromium.org Review URL: https://codereview.chromium.org/1636013002 Cr-Commit-Position: refs/heads/master@{#33521}
-
- 01 Dec, 2015 1 commit
-
-
neis authored
R=rossberg BUG=v8:1543 LOG=N Review URL: https://codereview.chromium.org/1481103002 Cr-Commit-Position: refs/heads/master@{#32457}
-
- 27 Nov, 2015 1 commit
-
-
pan.deng authored
BUG=None LOG=n Review URL: https://codereview.chromium.org/1473023004 Cr-Commit-Position: refs/heads/master@{#32354}
-
- 26 Oct, 2015 1 commit
-
-
jkummerow authored
along with follow-up fixes: - "introduce LookupIterator::Restart() and use it" - "always reset the LookupIterator before storing" - "API-style accessors can throw, check for that" Revert reason was fixed in Chromium: https://codereview.chromium.org/1415453003/ This reverts the following commits: 0188aead 984f8af8 dc9d2c16 a0f5d499 Review URL: https://codereview.chromium.org/1424503003 Cr-Commit-Position: refs/heads/master@{#31578}
-
- 23 Oct, 2015 1 commit
-
-
hablich authored
Revert of Introduce LookupIterator::Restart() and use it (patchset #2 id:20001 of https://codereview.chromium.org/1416053007/ ) Reason for revert: Breaks test if rolled into Chromium: http://build.chromium.org/p/chromium.win/buildstatus?builder=Vista%20Tests%20%281%29&number=60441 Needed so the reverts applies cleanly and seems to be related to the offending CL. Original issue's description: > Introduce LookupIterator::Restart() and use it > > Committed: https://crrev.com/5676415b4add059b78f98a9a762d00c8d721dbcd > Cr-Commit-Position: refs/heads/master@{#31483} TBR=verwaest@chromium.org,jkummerow@chromium.org NOPRESUBMIT=true NOTREECHECKS=true NOTRY=true Review URL: https://codereview.chromium.org/1418213003 Cr-Commit-Position: refs/heads/master@{#31534}
-
- 22 Oct, 2015 1 commit
-
-
jkummerow authored
Review URL: https://codereview.chromium.org/1416053007 Cr-Commit-Position: refs/heads/master@{#31483}
-
- 30 Sep, 2015 2 commits
-
-
jkummerow authored
Continuing unification of properties/elements handling, the new LookupIterator::PropertyOrElement(..., Handle<Object> key, ...) takes any Object and does the required ToPrimitive/ToName/ToArrayIndex conversions on it. Review URL: https://codereview.chromium.org/1375943002 Cr-Commit-Position: refs/heads/master@{#31023}
-
mstarzinger authored
This enables linter checking for "readability/namespace" violations during presubmit and instead marks the few known exceptions that we allow explicitly. R=bmeurer@chromium.org Review URL: https://codereview.chromium.org/1371083003 Cr-Commit-Position: refs/heads/master@{#31019}
-
- 14 Jul, 2015 2 commits
-
-
verwaest authored
BUG=v8:4137 LOG=n Review URL: https://codereview.chromium.org/1228803005 Cr-Commit-Position: refs/heads/master@{#29649}
-
verwaest authored
BUG=v8:4137 LOG=n Review URL: https://codereview.chromium.org/1238533003 Cr-Commit-Position: refs/heads/master@{#29645}
-
- 10 Jul, 2015 2 commits
-
-
verwaest authored
For now it uses a pretty slow path for accessing strings by wrapping it into a new temporary wrapper. BUG=v8:4042, v8:3088 LOG=y Review URL: https://codereview.chromium.org/1221303019 Cr-Commit-Position: refs/heads/master@{#29576}
-
verwaest authored
BUG=chromium:507980 LOG=n Review URL: https://codereview.chromium.org/1234553002 Cr-Commit-Position: refs/heads/master@{#29570}
-
- 06 Jul, 2015 1 commit
-
-
verwaest authored
BUG=v8:4137 LOG=n Review URL: https://codereview.chromium.org/1218813012 Cr-Commit-Position: refs/heads/master@{#29477}
-
- 01 Jul, 2015 1 commit
-
-
verwaest authored
This change changes bootstrapping semantics for intercepted global objects. Unlike before, we'll now also call into the interceptor during bootstrapping. This affects properties loaded from within the runtime, such as global.Array and global.Symbol. The embedder will need to make sure that those values are the expected values during bootstrapping. BUG=chromium:505998 LOG=n Review URL: https://codereview.chromium.org/1220813005 Cr-Commit-Position: refs/heads/master@{#29414}
-
- 17 Jun, 2015 2 commits
-
-
verwaest authored
Restores SortNumbers perf degrade BUG=chromium:495949, v8:4137 LOG=n Review URL: https://codereview.chromium.org/1177043009 Cr-Commit-Position: refs/heads/master@{#29095}
-
verwaest authored
BUG=chromium:500173 LOG=n Review URL: https://codereview.chromium.org/1194513003 Cr-Commit-Position: refs/heads/master@{#29074}
-
- 16 Jun, 2015 1 commit
-
-
wingo authored
R=rossberg@chromium.org LOG=N BUG= Review URL: https://codereview.chromium.org/1182303004 Cr-Commit-Position: refs/heads/master@{#29041}
-
- 12 Jun, 2015 1 commit
-
-
verwaest authored
BUG=v8:4137 LOG=n Review URL: https://codereview.chromium.org/1178893002 Cr-Commit-Position: refs/heads/master@{#29004}
-