- 21 Aug, 2019 24 commits
-
-
Andreas Haas authored
The LinkageLocation currently consists of two fields, a bit_field and a machine_type. The existing equality check only checked the equality of the bit_field, which meant that a FP register location and a GP register location could alias. I added a static {IsSameLocation} function which checks that not just the bit_field but also if one of the two locations at least has a subtype of the other. Note that we do not check for type-equality because {CanTailCall} checks, which are the main user of the LinkageLocation equality check, should pass even if the result types are in a sub-typing relationship. R=mstarzinger@chromium.org Bug: v8:9396 Change-Id: Iaa2d11311d0c18e8ffc1dd934e369106ab2456a6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1763533 Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by:Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#63319}
-
Jakob Kummerow authored
Change-Id: Ibab34553f1499bd5dee7cf7477284783cc0660fc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1763534Reviewed-by:
Andreas Haas <ahaas@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#63318}
-
Joshua Litt authored
This CL implements the nullish operator in bytecode as defined by: https://github.com/tc39/proposal-nullish-coalescing. It can be enabled by passing '--harmony-nullish'. Nullish is similar to logical operators, but instead of truthy/falsey values, it short circuits when it evaluates a null or undefined value. Bug: v8:9547 Change-Id: Ia0f55877fc2714482b5547942baef9733537d1b9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1738568Reviewed-by:
Sathya Gunasekaran <gsathya@chromium.org> Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Commit-Queue: Joshua Litt <joshualitt@chromium.org> Cr-Commit-Position: refs/heads/master@{#63317}
-
Georg Neis authored
Bug: v8:7790 Change-Id: I9a770fd6861c216121aef88f0119698edc0e224e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1763537 Commit-Queue: Georg Neis <neis@chromium.org> Commit-Queue: Maya Lekova <mslekova@chromium.org> Auto-Submit: Georg Neis <neis@chromium.org> Reviewed-by:
Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/master@{#63316}
-
Georg Neis authored
Bug: v8:7790 Change-Id: I6705e5399ad37201b89d5d6d5174138b22401ca1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762518Reviewed-by:
-
Georg Schmid authored
This CL consists of several preparatory steps for slices in Torque. Above all, it introduces a user-defined struct, torque_internal::Slice<T>, that performs bounds checking and returns references to elements in arrays. To enable this, several smaller changes were also made: - Constructors of internal classes such as torque_internal::Reference<T> now require a special 'Unsafe' argument, making it clear that there be dragons. - Struct methods are now declared during finalization. This allows instances of generic structs to have methods referring to the same struct. Previously, methods would be declared before the instance had been fully registered, leading to errors during type resolution. Furthermore, such methods were declared in a temporary namespace, that would then erroneously escape and lead to use-after-free issues. - Instances of TypeArgumentInference were not running in the correct (Torque) scopes, leading to type resolution errors. - The chain of ContextualVariable::Scope for any given ContextualVariable (such as CurrentScope) can now be walked, simplifying debugging. R=jgruber@chromium.org, tebbi@chromium.org Bug: v8:7793 Change-Id: I36f808f63cc3ce441062dfc56f511f24f1e3121e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1758322 Commit-Queue: Georg Schmid <gsps@google.com> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#63314}
-
Andreas Haas authored
The linkage should not have any knowledge about the existance of nodes. R=mstarzinger@chromium.org Bug: v8:9396 Change-Id: If10bf113c6ec19c434573a8d9bb7b736caef5dee Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1763532 Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by:
-
Michael Starzinger authored
This adds type reflection support to the {WebAssembly.Module.exports} as well as {WebAssembly.Module.imports} method. It also refactors existing reflective code to use the internal instead of the public embedder API, which is slightly more efficient anyways. R=ahaas@chromium.org TEST=mjsunit/wasm/type-reflection BUG=v8:7742 Change-Id: I88a6c7e9236a549808707c72e40a63302b7747a9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1763527Reviewed-by: -
Michael Starzinger authored
This just adds a test case checking against the current behavior, but expectations might change once the proposal is clarified. For details see: https://github.com/WebAssembly/js-types/issues/11 R=ahaas@chromium.org TEST=mjsunit/wasm/type-reflection BUG=v8:7742 Change-Id: I2fc502460c0a8094a414d138703b75497b2d1c6f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762517Reviewed-by:
-
Dan Elphick authored
Bug: v8:8510 Change-Id: Ie2b1cbbc136fecf3a81716b129e51857bd8db157 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762294Reviewed-by:
Tamer Tas <tmrts@chromium.org> Commit-Queue: Dan Elphick <delphick@chromium.org> Cr-Commit-Position: refs/heads/master@{#63310}
-
Igor Sheludko authored
This generates slightly better code and gives some performance. Bug: v8:8948 Change-Id: I958fed109c85d2b1a413c82b37e56a39766dd172 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762295 Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Igor Sheludko <ishell@chromium.org> Reviewed-by:
-
Simon Zünd authored
With the added parenthesis from a previous CL, clang-format does a decent job of formatting the nested ternary operator statement. R=leszeks@chromium.org Change-Id: If2f5db766b6234a44f771c167f9831adda5dbd43 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762301 Auto-Submit: Simon Zünd <szuend@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
-
Sigurd Schneider authored
This CL fixes a bug where function proxies were reported as functions instead as proxies to devtools, which caused dev-tools to call methods on the function, possibly triggering side-effects. Change-Id: I1d5d234b784601bd4b7ec91107e4b0cf0d877d07 Bug: chromium:995753 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762303Reviewed-by:
Yang Guo <yangguo@chromium.org> Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#63307}
-
Santiago Aboy Solanes authored
Bug: v8:6949, v8:9396 Change-Id: Ibb0979979e7092521cacf0931a98b4d5aa39a695 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1758306 Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#63306}
-
Maya Lekova authored
Bug: v8:7790 Change-Id: I5659dd0fd9cc9eb6c129dbdafbc678d6c62289c9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1763528 Commit-Queue: Maya Lekova <mslekova@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Auto-Submit: Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/master@{#63305}
-
Santiago Aboy Solanes authored
Methods TNodified: * CodeStubAssembler::LoadWeakFixedArrayLength * InterpreterAssembler::LoadAndUntagConstantPoolEntryAtOperandIndex * InterpreterAssembler::LoadWeakFixedArrayLength Bug: v8:6949, v8:9396 Change-Id: I30edf1799c35175799ebcca9d9e5d7a815997358 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1755845 Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Reviewed-by:
-
Michael Lippautz authored
The tests were assuming that the destructor leaves behind memory in a defined state when the object was allocated with placement new. Turns out gcc with no component builds optimizes away the resetting of the memory. There's a simpler way to test the functionality by inspecting global handle counts. Bug: v8:9639, chromium:995684 Change-Id: I253d84910414c62ca314507b20d2c819f925ea6e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762512 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#63303}
-
Ana Peško authored
Change-Id: If546b1d2dc7019424383ce047ac4eb0410e954f0 Bug: v8:9566 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762289Reviewed-by:
Peter Marshall <petermarshall@chromium.org> Commit-Queue: Ana Pesko <anapesko@google.com> Cr-Commit-Position: refs/heads/master@{#63302}
-
Joshua Litt authored
When regexp match indices are enabled, we stash required data in the JSRegExpResult object, and then build a JSRegExpResultIndices object lazily when the 'indices' property is accessed. This cl simply checks that fast and slow paths produce the same values for result.indices and result.indices.groups. Change-Id: I6322d8eaef4c6e5a0ed3a5aef8b2ff05ac2b2c7a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1763249Reviewed-by:
-
Keno Fischer authored
This set of macros was only used for one test, while another versions exists in the header file that's used in the rest of the tests. Clean up the duplication. R=ahaas@chromium.org, titzer@chromium.org Change-Id: I851c47a0748b5c78d9a966dfb59b95a3381e7cf7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1747179 Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by:
-
Michael Starzinger authored
This adds type reflection support to the {WebAssembly.Module.exports} as well as {WebAssembly.Module.imports} method. It also refactors existing reflective code to use the internal instead of the public embedder API, which is slightly more efficient anyways. R=ahaas@chromium.org TEST=mjsunit/wasm/type-reflection BUG=v8:7742 Change-Id: Ic51b7b4744f7b3ad056a778aecfc4614ca8d6e75 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762019 Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by: -
Michael Lippautz authored
Some scopes that were subtracted were not part of the outer scopes and thus can result in negative values. Change-Id: I2264b27c4b7a48075fed4e3afaa6b6dd27d8daa4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762299Reviewed-by:
-
Joshua Litt authored
Before this cl, we always added slack to JSRegExpResult's initial_map. However, this is incorrect. Now we only add slack to JSRegExpResult's initial map if we intend to actually append the indices descriptor. Bug: chromium:996099 Change-Id: Iac23e92415a9b60409915ff1de9634326ed109c5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1763064 Commit-Queue: Joshua Litt <joshualitt@chromium.org> Reviewed-by:
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/b05c392..5f675b2 Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/939b6b1..04a66c3 Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/a44d67c..5329779 Rolling v8/third_party/fuchsia-sdk: https://chromium.googlesource.com/chromium/src/third_party/fuchsia-sdk/+log/5fd2915..d677ea6 Rolling v8/third_party/googletest/src: https://chromium.googlesource.com/external/github.com/google/googletest/+log/d5e9e0c..c9ccac7 Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/c5d786f..ebf97a6 TBR=machenbach@chromium.org,tmrts@chromium.org Change-Id: I40a2ec0c70121e44744c25ed9f56b804d6df2cf5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762116Reviewed-by:
v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#63296}
-
- 20 Aug, 2019 16 commits
-
-
Shu-yu Guo authored
private name was not found in the current scope. Outer private names were sometimes coincidentally correctly resolved if the innermost ClassScope does not need to allocate a context and does not have a ScopeInfo. ClassScope: :LookupPrivateName was not walking the scope chain when a Change-Id: I18937e6cdf2ad4ae15825b11762fbec7a1358145 Bug: v8:9635 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1761547Reviewed-by:
-
Leszek Swirski authored
Since the mutability of HeapNumbers is determined by their owning object's descriptor array, we can remove the MutableHeapNumber type entirely, at the cost of a few fewer DCHECKs and a couple of TODOs to use the descriptor array information. This is a necessary step towards a follow-up which allows in-place Double -> Tagged transitions Design doc: https://docs.google.com/document/d/1VeKIskAakxQFnUBNkhBmVswgR7Vk6T1kAyKRLhqerb4/ Bug: v8:9606 Change-Id: I13209f9c86f1f204088f6fd80089e17d956b4a50 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1743972 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#63294}
-
Sathya Gunasekaran authored
Previously, without support for converting strings to numbers we'd switch to megamorphic state and go to the runtime always to do the conversion causing a performance cliff. This patch improves the following js-perf-test scores: Object-Lookup-String-Constant-BytecodeHandler: 4.25% Object-Lookup-Index-String-BytecodeHandler: 5.41% Bug: v8:9449 Change-Id: I63787fa84373fc946f1304b0141e48a52a1b4bcb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1690953Reviewed-by:
Igor Sheludko <ishell@chromium.org> Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org> Cr-Commit-Position: refs/heads/master@{#63293}
-
Ng Zhi An authored
Bug: v8:9528 Change-Id: I7df27c3ee949a4c44fa0f78cfded6d8c34575e6b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1754445Reviewed-by:
-
Maya Lekova authored
ReduceTypedArrayPrototypeToStringTag, ReduceObjectGetPrototype and ReduceObjectGetPrototype are now heap-access free. Bug: v8:7790 Change-Id: If7f7ae4c7712326240aa50e02189fee94a57afa9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762022 Commit-Queue: Maya Lekova <mslekova@chromium.org> Reviewed-by:
-
Dan Elphick authored
5th attempt to reland now that crash with cpu profiler combined with code caching is fixed. Bug: v8:8510 Change-Id: I3489150a5067c41c36a4b468e412f9398a55135d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762293Reviewed-by:
-
Michael Lippautz authored
TracedGlobal is already cleared by V8 during garbage collections. It's the embedders responsibility to clear the reference if it destroys the underlying reference through other means. Allow embedders to specify whether they want TracedGlobal to execute clear on destruction via TracedGlobalTrait. Bug: chromium:995684 Change-Id: Ieb10cf21f95eb97e01eff15d4fbd83538f17cf7c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762007 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
-
Santiago Aboy Solanes authored
Follow-up CL that TNodifies loads from AnyTagged to TaggedPointer in interpreter-generator.cc for: * DescriptorArray::kEnumCacheOffset * EnumCache::kKeysOffset * EnumCache::kIndicesOffset * JSFunction::kSharedFunctionInfoOffset * JSGeneratorObject::kParametersAndRegistersOffset * JSGeneratorObject::kContextOffset * SourceTextModule::kRegularExportsOffset * SourceTextModule::kRegularImportsOffset Bug: v8:6949, v8:9396 Change-Id: I559d2a5ea353fbd9e1f539f30ce981d70d93714f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1752858 Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Reviewed-by:
-
Mathias Bynens authored
This feature shipped in V8 v7.4: https://v8.dev/blog/v8-release-74#faster-calls-with-arguments-mismatch Bug: v8:8895 Change-Id: I55c50aeda6c61d07b37987404ea09266c9f66702 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762026Reviewed-by:
-
Dan Elphick authored
When deserializing from a code snapshot with logging enabled (e.g. when profiling) then this ensures source positions are collected before creating code events that need them. Bug: chromium:994673, v8:9504 Change-Id: Iad7644e983d3004c4889615cf2104dc4ef40da46 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762023Reviewed-by:
-
Seth Brenith authored
Extend the order-independent annotation parsing logic to include the following forms: @foo // bare annotation (already supported) @foo(0x70) // decimal literal @foo(HI) // identifier @foo("hello there") // quoted string This is obviously still pretty far from annotations in other languages, which usually support arbitrary expressions and multiple parameters, but I think it's sufficient to cover a pretty good variety of usages. The existing class-field annotations @if and @ifnot are reimplemented in the new style, meaning they could now appear in any order relative to other annotations on the same field (and can be repeated, though I doubt it would be of much use to anybody). Change-Id: I97b7c0c9a541ca3126b5ae3a2484688b04dda9f4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1754947 Commit-Queue: Seth Brenith <seth.brenith@microsoft.com> Reviewed-by: -
Joyee Cheung authored
This patch implements the declaration of private accessors. When iterating over the class properties, we track private accessors associated with the same name in a ZoneHashMap. Once we get to all the necessary components for a private name (we know statically whether we should expect only a setter, only a getter, or both), we emit a call to a runtime function `CreatePrivateAccessors` that creates an AccessorPair, and store the components in it. The AccessorPair is then associated with the private name variable and stored in the context for later retrieval when the private accessors are accessed. Design doc: https://docs.google.com/document/d/10W4begYfs7lmldSqBoQBBt_BKamgT8igqxF9u50RGrI/edit Bug: v8:8330 Change-Id: Ie6d3882507d143b1f645d7ae82b21b7358656e89 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1725670 Commit-Queue: Joyee Cheung <joyee@igalia.com> Reviewed-by:
-
Dan Elphick authored
Fixes bytecode mismatch between lazy and non-lazy where "this" was marked as maybe assigned in constructors that called the super constructor. Since this will return the hole in cases where it was not yet initialized by super (and the hole is explicitly handled by JSContextSpecialization::ReduceJSLoadContext), it's safe to treat it as a constant in all cases. In the case of lazy compilation case, "this" is never added to the ScopeInfo so is never seen as mutable. Bug: chromium:994719 Change-Id: I43478fbc626b19eb1533aa9dec61b7f276ae140b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762025 Commit-Queue: Dan Elphick <delphick@chromium.org> Reviewed-by:
-
Dominik Inführ authored
Do not pass it as argument to CreateObjectFillerAt and remove the enum. Bug: v8:9454 Change-Id: Iafa37acbfea73d3cabb1732dbec0944db859fac2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762017Reviewed-by:
-
Keno Fischer authored
Before dd6f4d4f, this function was reading a single u8 and verifying that it was 0x00. The referenced commit dropped this check as part of implementing decoding for table.get, but neglected to change the read type to u32v, which is the specified type of this immediate. Fix that. R=ahaas@chromium.org, titzer@chromium.org Change-Id: Ic2ce795023ec57be2c95aa79e62d3ccd1aa9c43c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1747178 Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by:
-
Jakob Kummerow authored
This just adds the upstream tests; our implementation already had support. Change-Id: If8d340ebe79eae65d12164a01883482d521b8451 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762287Reviewed-by:
-
