- 28 May, 2020 1 commit
-
-
Mike Stanton authored
Bug: v8:8906 Change-Id: Ie83540f9dd9448a09c5a8af0c7b7e1ea58aaf497 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2110029Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Michael Stanton <mvstanton@chromium.org> Cr-Commit-Position: refs/heads/master@{#68040}
-
- 04 May, 2020 1 commit
-
-
Igor Sheludko authored
Bug: v8:10391 Change-Id: I316a3c5cd986a74d7f46da6d0b85cb3d549be497 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2153209 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#67533}
-
- 01 May, 2020 1 commit
-
-
Igor Sheludko authored
Bug: v8:10391 Change-Id: If1db52dc74f9027f06104ce719514b751b4d9504 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2149417 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#67515}
-
- 28 Feb, 2020 1 commit
-
-
Seth Brenith authored
Previously, our Torque definition of JSArrayBuffer included only the first two fields. This allowed access to those two fields, but was somewhat confusing and obviously didn't let Torque code access the other fields. This change: - Completes the JSArrayBuffer layout definition; - Moves the associated bitfield struct definition to Torque; - Moves a couple of JSArrayBuffer macros to Torque; - Adds a reducer case so that the code generated using these new macros is not worse than what was generated previously. Change-Id: Ib19c3ba789a33801fa9d0d064cd21d62a1e03e30 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2053769 Commit-Queue: Seth Brenith <seth.brenith@microsoft.com> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#66503}
-
- 17 Feb, 2020 2 commits
-
-
Jakob Kummerow authored
There is a copy of the pointer decompression logic in TypedArrayBuiltinsAssembler::SetJSTypedArrayOnHeapDataPtr, which was not updated for the new ("smi-corrupting") pointer compression scheme: it erroneously used a sign-extending cast from compressed to full representation. This causes incorrect values to be computed when the heap size can grow beyond 2GB. Bug: v8:9706, chromium:1051005 Change-Id: I2220ce759df1147f255ffca93428888858929fd9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2060494Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#66293}
-
Santiago Aboy Solanes authored
Bug: v8:6949, v8:10155 Change-Id: I0113efe2d4d3a462533c306a87ebee851b1cb85c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2056853Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Cr-Commit-Position: refs/heads/master@{#66286}
-
- 13 Jan, 2020 2 commits
-
-
Santiago Aboy Solanes authored
TNodified: * StoreObjectField * StoreObjectFieldNoWriteBarrier Bug: v8:10021 Change-Id: I74b34af410c560a1b005c0b93c71468ef57087fe Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1993296 Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by: Dan Elphick <delphick@chromium.org> Cr-Commit-Position: refs/heads/master@{#65733}
-
Dominik Inführ authored
This CL adds the ArrayBufferExtension class, which is used to track JSArrayBuffers in a linked list. The ArrayBufferExtension is going to replace the ArrayBufferTracker in the future but is currently behind the v8_enable_array_buffer_extension feature flag. When enabled, each JSArrayBuffer has a corresponding native-heap allocated ArrayBufferExtension object. All extensions are currently tracked in a single linked list. During marking the GC not only marks the JSArrayBuffer but also its extension object. At the end of mark-compact the GC iterates all extensions and removes unmarked ones. Change-Id: I88298be255944d5ae1327c91b0d7f0fdbcd486d5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1969791Reviewed-by: Peter Marshall <petermarshall@chromium.org> Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/master@{#65724}
-
- 06 Nov, 2019 1 commit
-
-
Igor Sheludko authored
... in an uintptr friendly way. Drive-by-fix: 1) IsForceSlowPath() check is integrated into Cast<FastJSArray> 2) disable tests incompatible with --force-slow-path in "slow_path" variant Bug: v8:8906, v8:4153 Change-Id: I427f117073bc295120aa52fb3fe023ee04d58302 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1899988 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#64799}
-
- 05 Nov, 2019 1 commit
-
-
Igor Sheludko authored
Bug: v8:8996 Change-Id: I822c945c56738a1bb0561c208e321d70fd96f863 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1895568Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#64768}
-
- 04 Nov, 2019 1 commit
-
-
Igor Sheludko authored
... in an uintptr index friendly way. Bug: v8:8906, v8:4153 Change-Id: Ib06ac205453fe3ff653b4fb73194e1ab53ca0d00 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1891610 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#64731}
-
- 31 Oct, 2019 1 commit
-
-
Igor Sheludko authored
This is a cleanup before we introduce StoreTypedElementJSAny<T: type>() which are necessary for porting %TypedArray%.from to Torque. Drive-by-fix: formatted third_party/v8/builtins/array-sort.tq Bug: v8:8906 Change-Id: Ic84cb763ae7e5d400b5d7f7b102baa497fe9fe91 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1893331 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#64690}
-
- 30 Oct, 2019 1 commit
-
-
Santiago Aboy Solanes authored
Bug: v8:9810 Change-Id: I2893c3066616b8fb5b3bebde4797adb0dac109c4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1889878 Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Reviewed-by: Maya Lekova <mslekova@chromium.org> Reviewed-by: Mythri Alle <mythria@chromium.org> Cr-Commit-Position: refs/heads/master@{#64659}
-
- 22 Oct, 2019 1 commit
-
-
Igor Sheludko authored
Bug: v8:4153 Change-Id: Icd346fae1dea9e56527b8669ace1aa6cfd46e87a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1872393 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#64475}
-
- 17 Oct, 2019 1 commit
-
-
Igor Sheludko authored
The CL fixes the following builtins: %TypedArray%.prototype.join %TypedArray%.prototype.every %TypedArray%.prototype.find %TypedArray%.prototype.findIndex %TypedArray%.prototype.forEach %TypedArray%.prototype.reduce %TypedArray%.prototype.reduceRight %TypedArray%.prototype.some Bug: v8:4153 Change-Id: I39cdb1801949b1df9d221988b8ed4ed5b2de9341 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1864941Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#64345}
-
- 10 Oct, 2019 1 commit
-
-
Dan Elphick authored
Bug: v8:6949 Change-Id: I7f41d72a4726cff0e61ff9cbe3fc3f18930f0da1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1852128 Auto-Submit: Dan Elphick <delphick@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#64216}
-
- 01 Oct, 2019 1 commit
-
-
Joshua Litt authored
Removes the static protector values from isolate now that they are no longer needed. This is the final cl in the migration effort. Bug: v8:9463 Change-Id: I2127ef6c8a0cdaf0ccf28aed12539335ef985704 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1827455Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Commit-Queue: Joshua Litt <joshualitt@chromium.org> Cr-Commit-Position: refs/heads/master@{#64068}
-
- 23 Sep, 2019 1 commit
-
-
Dan Elphick authored
Move CodeStubAssembler::StoreJSTypedArrayElementFromTagged, SetJSTypedArrayOnHeapDataPtr and SetJSTypedArrayOffHeapDataPtr into TypedArrayBuiltinsAssembler. Bug: v8:9396 Change-Id: I16e6aa82d0de9bd1d29a9e2c095032f2c6dd5e29 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1817611Reviewed-by: Jakob Gruber <jgruber@chromium.org> Commit-Queue: Dan Elphick <delphick@chromium.org> Cr-Commit-Position: refs/heads/master@{#63930}
-
- 19 Sep, 2019 2 commits
-
-
Igor Sheludko authored
This is a reland of 6f9b2bd4 We must load JSTypedArray::base_pointer in TurboFan as tagged value otherwise this value may become stale pointer after GC. Original change's description: > [ptr-compr] Make on-heap JSTypedArrays smi-corrupting friendly > > On-heap typed arrays contain HeapObject value in |base_pointer| field > and an offset in |external_pointer| field. When pointer compression is > enabled we want to combine decompression with the offset addition. > In order to do that we add an isolate root to the external_pointer value > and therefore the data pointer computation can is a simple addition of > a (potentially sign-extended) |base_pointer| loaded as Tagged_t value > and an |external_pointer| value. > > Bug: v8:9706 > Change-Id: Id5c546c353c81fb25e3598921bc78165d10a9c44 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1807369 > Reviewed-by: Ulan Degenbaev <ulan@chromium.org> > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Reviewed-by: Georg Neis <neis@chromium.org> > Commit-Queue: Igor Sheludko <ishell@chromium.org> > Cr-Commit-Position: refs/heads/master@{#63874} Bug: v8:9706, chromium:1005599 Cq-Include-Trybots: luci.chromium.try:gpu-fyi-try-win10-nvidia-rel-64 Change-Id: I7bbd2a439306cdd11f2bb0dab5863498624d9740 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1813744Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#63898}
-
Clemens Hammacher authored
This reverts commit 6f9b2bd4. Reason for revert: Fails on nvidia bots, blocking LKGR: https://ci.chromium.org/p/v8/builders/ci/Win%20V8%20FYI%20Release%20(NVIDIA)/5005 Original change's description: > [ptr-compr] Make on-heap JSTypedArrays smi-corrupting friendly > > On-heap typed arrays contain HeapObject value in |base_pointer| field > and an offset in |external_pointer| field. When pointer compression is > enabled we want to combine decompression with the offset addition. > In order to do that we add an isolate root to the external_pointer value > and therefore the data pointer computation can is a simple addition of > a (potentially sign-extended) |base_pointer| loaded as Tagged_t value > and an |external_pointer| value. > > Bug: v8:9706 > Change-Id: Id5c546c353c81fb25e3598921bc78165d10a9c44 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1807369 > Reviewed-by: Ulan Degenbaev <ulan@chromium.org> > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Reviewed-by: Georg Neis <neis@chromium.org> > Commit-Queue: Igor Sheludko <ishell@chromium.org> > Cr-Commit-Position: refs/heads/master@{#63874} TBR=ulan@chromium.org,neis@chromium.org,jgruber@chromium.org,ishell@chromium.org,verwaest@chromium.org Change-Id: I901280dd191e78d02969600f775c4f0da796921f No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:9706 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1813027Reviewed-by: Clemens Hammacher <clemensh@chromium.org> Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#63886}
-
- 18 Sep, 2019 1 commit
-
-
Igor Sheludko authored
On-heap typed arrays contain HeapObject value in |base_pointer| field and an offset in |external_pointer| field. When pointer compression is enabled we want to combine decompression with the offset addition. In order to do that we add an isolate root to the external_pointer value and therefore the data pointer computation can is a simple addition of a (potentially sign-extended) |base_pointer| loaded as Tagged_t value and an |external_pointer| value. Bug: v8:9706 Change-Id: Id5c546c353c81fb25e3598921bc78165d10a9c44 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1807369Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#63874}
-
- 16 Sep, 2019 1 commit
-
-
Dan Elphick authored
All converted except for two calls to PrepareValueForWriteToTypedArray. Bug: v8:6949, v8:9396 Change-Id: I3c695b8067487bd8845e38cf760519bef1f37f2b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1803351 Auto-Submit: Dan Elphick <delphick@chromium.org> Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org> Commit-Queue: Dan Elphick <delphick@chromium.org> Cr-Commit-Position: refs/heads/master@{#63782}
-
- 13 Sep, 2019 1 commit
-
-
Igor Sheludko authored
Bug: v8:9708 Change-Id: I91e429e478ad70dc2212f9f78830d10941fa47e6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1800581Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#63740}
-
- 12 Sep, 2019 2 commits
-
-
Igor Sheludko authored
Bug: v8:9708 Change-Id: I305cc007a4e7302c8587b999cbb11f23ced4cfd3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1800579 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/master@{#63735}
-
Tobias Tebbi authored
This enables using TNode types without including code-assembler.h, which is useful when generating CallInterfaceDescriptors. As a drive-by, this moves TNode from v8::internal::compiler to v8::internal. It's only used outside of the compiler anyway. Change-Id: I3d938c22366a3570315041683094f77b0d1096a2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1798425 Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Michael Stanton <mvstanton@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/master@{#63721}
-
- 04 Sep, 2019 1 commit
-
-
Georg Neis authored
Change-Id: I29a4d20656727e6ec1e1fd052a840bd5aefe3cd4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1781052 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#63544}
-
- 27 Aug, 2019 1 commit
-
-
Leszek Swirski authored
Using the tool again, the previous iteration accidentally ignored Node/TNode behind a typedef. Automatic replacement of types with manual cleanup/addition of CASTs where necessary. Bug: v8:9396 Change-Id: I33b6d229669cb80586d5d8e82c04542df671f0b9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1768367 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#63409}
-
- 26 Aug, 2019 1 commit
-
-
Leszek Swirski authored
Forbid using LoadRoot in CSA (with a bailout via CodeAssembler), so that users are forced to use helper macros for roots, which have statically known types. Convert all current uses of LoadRoot to use these macros, introducing new ones where necessary. Bug: v8:9396 Change-Id: I91214fca6e5ace7554d79605706a8a60117468fa Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762526 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#63398}
-
- 23 Aug, 2019 1 commit
-
-
Leszek Swirski authored
Replace uses of WordEqual on two tagged representation nodes with a new TaggedEqual helper, which on pointer compressed configs only compares the bottom 32-bits of the word. We no longer allow using WordEqual on anything not known to be a WordT (i.e. Node* or TNode<Object>). In the future, this may allow us to ignore the top bits of an uncompressed Smi, and have simpler decompression, though this patch is not sufficient for such a change. As a necessary drive-by, TNodify a bunch of stuff. Bug: v8:8948 Change-Id: Ie11b70709e5d3073f12551b37b420a172a71bc99 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1763531 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org> Cr-Commit-Position: refs/heads/master@{#63372}
-
- 19 Jun, 2019 1 commit
-
-
Tobias Tebbi authored
This disallows using CSA macros from Torque that have a Node* return type instead of TNode<>. By enforcing CSA types at the boundary between CSA and Torque, we can ensure that the Torque types and the CSA types match. As a drive-by, this CL adds a bit more of CSA typing where it made sense. Bug: v8:7793, v8:6949 Change-Id: I12ea0337c628105ea3c420be747ae50d3a172547 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1660481 Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#62293}
-
- 18 Jun, 2019 1 commit
-
-
Ben L. Titzer authored
Extract the maximum on-heap typed array size to a constant in the JSTypedArray class. Add tests for allocating typed arrays of various sizes and validate through the API whether they are allocated on heap. It is not possible to observe from JavaScript. R=mstarzinger@chromium.org Change-Id: I1298e0a49010de829edaad32b7d6c6c9c52704fb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1662572 Commit-Queue: Ben Titzer <titzer@chromium.org> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#62257}
-
- 12 Jun, 2019 1 commit
-
-
Seth Brenith authored
This change adjusts object initialization order for a few classes so that the GC can never see those objects in an invalid, partially- initialized state. AccessorInfo: Just zeros out a few fields upon construction. This is the simplest case. FunctionTemplateInfo: Slightly changes the order in which fields are set, so that the Smi field is set ahead of the call to SetCallHandler, which can GC. Also a pretty simple case. JSListFormat, JSPluralRules, JSRelativeTimeFormat, JSSegmenter: The spec requires that we start with OrdinaryCreateFromConstructor, which has observable side effects (it fetches the prototype from the new.target). So we split JSObject::New in half: the first half does all of the user- visible things and returns a Map, which we can pass to the second half when we're ready to actually allocate the object. JSTypedArray: Extends the pattern from JSListFormat into Torque code: start with a Map and don't allocate the object until we're ready to set all of its properties. Bug: v8:9311 Change-Id: Id7703e8a0727ec756c774cfbb56af787658a111a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1646844 Commit-Queue: Seth Brenith <seth.brenith@microsoft.com> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Sigurd Schneider <sigurds@chromium.org> Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#62123}
-
- 27 May, 2019 4 commits
-
-
Tobias Tebbi authored
Instead of generating one CodeStubAssembler-like class per namespace, Torque-generated macros are now free-standing functions not included from CSA code, and explicitly exported macros become part of the new TorqueGeneratedExportedMacrosAssembler, which CodeStubAssembler inherits from, thus making them available to all CSA code. Structs are now defined in a new header csa-types-tq.h as free-standing types with the prefix "TorqueStruct". This is a preparation for generating per Torque-file instead of per namespace. Change-Id: I60fadc493a63f85d1d340768ec6f11ae47be0cb8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1628787 Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#61865}
-
Benedikt Meurer authored
This is a reland of 4b86fea5 with copy&paste typo in CodeStubAssembler::AllocateByteArray() fixed (bug led to holes in new space, which was crashing reproducibly on the ia32 bot). Original change's description: > [typedarray] Move external/data pointer to JSTypedArray. > > As the next step in supporting huge typed arrays in V8, this moves the > external/data pointer from the FixedTypedArrayBase backing store to the > JSTypedArray instance itself, and replaces the special backing stores > with a plain ByteArray (removing all the code for the FixedTypedArrayBase > class hierarchy). By doing so, we can drastically simplify the system > around typed arrays. > > Note: Several places in the code base used to check the instance type > of the elements backing store of a JSTypedArray instead of checking the > elements kind on the JSTypedArray map directly. Those had to be fixed, > since the backing store is now always a ByteArray. > > Drive-by-fix: Move all the typed elements access related code into the > elements.cc file to properly encapsulate the accesses. > > Doc: http://doc/1Z-wM2qwvAuxH46e9ivtkYvKzzwYZg8ymm0x0wJaomow > Bug: chromium:951196, chromium:965583, v8:4153, v8:7881, v8:9183 > Change-Id: I8cc06b190c53e34155000b4560f5f3ef40621646 > Cq-Include-Trybots: luci.chromium.try:linux-rel,win7-rel > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627535 > Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> > Reviewed-by: Peter Marshall <petermarshall@chromium.org> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org> > Reviewed-by: Simon Zünd <szuend@chromium.org> > Cr-Commit-Position: refs/heads/master@{#61855} Tbr: petermarshall@chromium.org Bug: chromium:951196, chromium:965583, v8:4153, v8:7881, v8:9183 Change-Id: I87fcdb28532c5f08cc227332a4d59546cb423810 Cq-Include-Trybots: luci.chromium.try:linux-rel, win7-rel Cq-Include-Trybots: luci.v8.try:v8_linux_shared_compile_rel Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1631592Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#61864}
-
Clemens Hammacher authored
This reverts commit 4b86fea5. Reason for revert: Fails on linux shared: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20shared/31045 Original change's description: > [typedarray] Move external/data pointer to JSTypedArray. > > As the next step in supporting huge typed arrays in V8, this moves the > external/data pointer from the FixedTypedArrayBase backing store to the > JSTypedArray instance itself, and replaces the special backing stores > with a plain ByteArray (removing all the code for the FixedTypedArrayBase > class hierarchy). By doing so, we can drastically simplify the system > around typed arrays. > > Note: Several places in the code base used to check the instance type > of the elements backing store of a JSTypedArray instead of checking the > elements kind on the JSTypedArray map directly. Those had to be fixed, > since the backing store is now always a ByteArray. > > Drive-by-fix: Move all the typed elements access related code into the > elements.cc file to properly encapsulate the accesses. > > Doc: http://doc/1Z-wM2qwvAuxH46e9ivtkYvKzzwYZg8ymm0x0wJaomow > Bug: chromium:951196, chromium:965583, v8:4153, v8:7881, v8:9183 > Change-Id: I8cc06b190c53e34155000b4560f5f3ef40621646 > Cq-Include-Trybots: luci.chromium.try:linux-rel,win7-rel > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627535 > Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> > Reviewed-by: Peter Marshall <petermarshall@chromium.org> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org> > Reviewed-by: Simon Zünd <szuend@chromium.org> > Cr-Commit-Position: refs/heads/master@{#61855} TBR=ulan@chromium.org,yangguo@chromium.org,titzer@chromium.org,sigurds@chromium.org,petermarshall@chromium.org,bmeurer@chromium.org,szuend@chromium.org Change-Id: I0bc1f935de6063acf75a0f4bb8c0ba67428603fd No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: chromium:951196, chromium:965583, v8:4153, v8:7881, v8:9183 Cq-Include-Trybots: luci.chromium.try:linux-rel, win7-rel Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1631427Reviewed-by: Clemens Hammacher <clemensh@chromium.org> Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#61856}
-
Benedikt Meurer authored
As the next step in supporting huge typed arrays in V8, this moves the external/data pointer from the FixedTypedArrayBase backing store to the JSTypedArray instance itself, and replaces the special backing stores with a plain ByteArray (removing all the code for the FixedTypedArrayBase class hierarchy). By doing so, we can drastically simplify the system around typed arrays. Note: Several places in the code base used to check the instance type of the elements backing store of a JSTypedArray instead of checking the elements kind on the JSTypedArray map directly. Those had to be fixed, since the backing store is now always a ByteArray. Drive-by-fix: Move all the typed elements access related code into the elements.cc file to properly encapsulate the accesses. Doc: http://doc/1Z-wM2qwvAuxH46e9ivtkYvKzzwYZg8ymm0x0wJaomow Bug: chromium:951196, chromium:965583, v8:4153, v8:7881, v8:9183 Change-Id: I8cc06b190c53e34155000b4560f5f3ef40621646 Cq-Include-Trybots: luci.chromium.try:linux-rel,win7-rel Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627535 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Peter Marshall <petermarshall@chromium.org> Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Reviewed-by: Simon Zünd <szuend@chromium.org> Cr-Commit-Position: refs/heads/master@{#61855}
-
- 23 May, 2019 1 commit
-
-
Yang Guo authored
Bug: v8:9247 Change-Id: I0023200c54fa6499ae4e2cf5e4c89407cc35f187 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1624218Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Andreas Haas <ahaas@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Michael Stanton <mvstanton@chromium.org> Commit-Queue: Yang Guo <yangguo@chromium.org> Cr-Commit-Position: refs/heads/master@{#61762}
-
- 15 May, 2019 1 commit
-
-
Tobias Tebbi authored
With very few exceptions, this verifies all skipped write-barriers in CSA and Torque, showing that the MemoryOptimizer together with some type information on the stored value are enough to avoid unsafe skipped write-barriers. Changes to CSA: SKIP_WRITE_BARRIER and Store*NoWriteBarrier are verified by the MemoryOptimizer by default. Type information about the stored values (TNode<Smi>) is exploited to safely skip write barriers for stored Smi values. In some cases, the code is re-structured to make it easier to consume for the MemoryOptimizer (manual branch and load elimination). Changes to the MemoryOptimizer: Improve the MemoryOptimizer to remove write barriers: - When the store happens to a CSA-generated InnerAllocate, by ignoring Bitcasts and additions. - When the stored value is the HeapConstant of an immortal immovable root. - When the stored value is a SmiConstant (recognized by BitcastToTaggedSigned). - Fast C-calls are treated as non-allocating. - Runtime calls can be white-listed as non-allocating. Remaining missing cases: - C++-style iterator loops with inner pointers. - Inner allocates that are reloaded from a field where they were just stored (for example an elements backing store). Load elimination would fix that. - Safe stored value types that cannot be expressed in CSA (e.g., Smi|Hole). We could handle that in Torque. - Double-aligned allocations, which are not lowered in the MemoryOptimizer but in CSA. Drive-by change: Avoid Smi suffix for StoreFixedArrayElement since this can be handled by overload resolution (in Torque and C++). Reland Change: Support pointer compression operands. R=jarin@chromium.org TBR=mvstanton@chromium.org Bug: v8:7793 Change-Id: I84e1831eb6bf9be14f36db3f8b485ee4fab6b22e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1612904 Auto-Submit: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Michael Stanton <mvstanton@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#61522}
-
- 14 May, 2019 2 commits
-
-
Sigurd Schneider authored
This CL introduces the new suffix '-tq' for Torque generated files, and replaces the infix 'FromDSL' in type names with a prefix 'TorqueGenerated'. Change-Id: I1e90460cc0c666da6cf5017e8b3cb7c39c6ac668 Bug: v8:7793 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1609798 Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#61490}
-
Benedikt Meurer authored
This is a mostly mechanical change that updates the JSTypedArray::length field to have uintptr_t storage. It doesn't change the allowed ranges for this field yet, that will be done separately later on. Bug: v8:4153, v8:7881 Change-Id: Ia4b6f5455bd97b82a4b980d77bda0b09cfa845f5 Doc: http://doc/1Z-wM2qwvAuxH46e9ivtkYvKzzwYZg8ymm0x0wJaomow Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1607647 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#61485}
-