- 20 Nov, 2017 19 commits
-
-
Peter Marshall authored
This reverts commit b6658ade. Reason for revert: Breaks TSAN :( Original change's description: > [heap] Concurrently free ArrayBuffer allocations. > > Free ArrayBuffer backing stores on a background thread, rather than > blocking the main thread after processing. Could potentially cause > contention with the array buffer allocator once JS execution resumes. > > The new ArrayBufferCollector class tracks these dead allocations. > > Later, the processing of array buffers can happen in parallel. > > Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng > > Bug: v8:6992 > Change-Id: I49ae4db12ed62d8400ba2bbafeda05a11479d904 > Reviewed-on: https://chromium-review.googlesource.com/739829 > Commit-Queue: Peter Marshall <petermarshall@chromium.org> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Reviewed-by: Hannes Payer <hpayer@chromium.org> > Cr-Commit-Position: refs/heads/master@{#49485} TBR=hpayer@chromium.org,mlippautz@chromium.org,petermarshall@chromium.org Change-Id: If6743b83f871c0fd0d6e83a3083dce0eecd99021 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:6992 Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng Reviewed-on: https://chromium-review.googlesource.com/779159Reviewed-by:
Peter Marshall <petermarshall@chromium.org> Commit-Queue: Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#49488}
-
Michael Achenbach authored
This updates the V8 side MB fork with all upstream changes until: https://chromium.googlesource.com/chromium/src/+/f4d92a15f/tools/mb/mb.py This includes a required feature for mapping isolate targets to runtime deps. Bug: chromium:669910 Change-Id: I22244455b22737cfbfc45adef93581ef44cf4151 Reviewed-on: https://chromium-review.googlesource.com/778879Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/master@{#49487}
-
Benedikt Meurer authored
Avoid the stupid newline when the name is a String, which is automatically appended by the Object::Print() method. Just use the Name::NamePrint() method instead. Bug: v8:5267 Change-Id: I12ec878325b6f6ecdd8633a5ac8129b2398ddf9a Reviewed-on: https://chromium-review.googlesource.com/778823Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#49486}
-
Peter Marshall authored
Free ArrayBuffer backing stores on a background thread, rather than blocking the main thread after processing. Could potentially cause contention with the array buffer allocator once JS execution resumes. The new ArrayBufferCollector class tracks these dead allocations. Later, the processing of array buffers can happen in parallel. Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng Bug: v8:6992 Change-Id: I49ae4db12ed62d8400ba2bbafeda05a11479d904 Reviewed-on: https://chromium-review.googlesource.com/739829 Commit-Queue: Peter Marshall <petermarshall@chromium.org> Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
Hannes Payer <hpayer@chromium.org> Cr-Commit-Position: refs/heads/master@{#49485}
-
jgruber authored
When collecting source ranges for conditionals (`a ? b : c`), include the '?' and ':' tokens in the then- and else ranges, respectively. Bug: v8:7098 Change-Id: I22315e2040c96c977e0b49e1fafe4228a6558471 Reviewed-on: https://chromium-review.googlesource.com/778321Reviewed-by:
Marja Hölttä <marja@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#49484}
-
Ross McIlroy authored
This moves the logging of the RCS event for background parsing tasks out of the parser and performs it at the end of the background parsing task. This is necessary in order to log background compile RCS events which happen after parsing. BUG=v8:5203 Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng Change-Id: Ie216eeade0279d8243818a8eb59309969775823c Reviewed-on: https://chromium-review.googlesource.com/776669Reviewed-by:
-
Benedikt Meurer authored
For the fast case we can avoid the instance type check, since the map check covers that. We also don't need to call out to the ToBoolean builtin in general, but just use the BranchIfToBooleanIsTrue logic. Plus in the fast case, we don't know that the JSIteratorResult::done is a boolean, since the map doesn't guard this assumption, so we also need to do a proper BranchIfToBooleanIsTrue in that case. Bug: v8:5269 Change-Id: I36f0d0841472c02f8030f9ce067d20326c9388bd Reviewed-on: https://chromium-review.googlesource.com/778882Reviewed-by:
-
Daniel Clifford authored
Bug: chromium:785804 Change-Id: I1a65e2007438ac009d961e0e2c0425212216fcf1 Reviewed-on: https://chromium-review.googlesource.com/776696Reviewed-by:
Igor Sheludko <ishell@chromium.org> Commit-Queue: Daniel Clifford <danno@chromium.org> Cr-Commit-Position: refs/heads/master@{#49481}
-
Benedikt Meurer authored
We can just use the same trick here that we use with TurboFan and load the (signaling) NaN value out of the canonical tagged root. This improves the loop for initializing double backing stores by hoisting the load of the constant value out of the loop. Bug: v8:5267 Change-Id: Idcf07c0e910ecc085a8b89225613f0a8fb50a414 Reviewed-on: https://chromium-review.googlesource.com/778979Reviewed-by:
Daniel Clifford <danno@chromium.org> Cr-Commit-Position: refs/heads/master@{#49480}
-
Sergiy Byelozyorov authored
TBR=machenbach@chromium.org Bug: chromium:748000 Change-Id: I383a1203b094d1e17453ee5aabca3267132df363 Reviewed-on: https://chromium-review.googlesource.com/778540Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Reviewed-by:
Sergiy Byelozyorov <sergiyb@chromium.org> Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org> Cr-Commit-Position: refs/heads/master@{#49479}
-
Benedikt Meurer authored
Bug: v8:5267 Change-Id: I2338702ef69298bc95c47dcfedf7ef7632a2bf7f Reviewed-on: https://chromium-review.googlesource.com/778842Reviewed-by:
-
Michael Achenbach authored
When using ninja to build without specifying explicit targets, all existing targets in any BUILD.gn file are built/executed. We now hide the snapshot targets behind the snapshot condition to prevent them from being built and executed in nosnap builds. CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_linux_nosnap_rel Bug: v8:7089 Change-Id: I4cd8ebadc377fd20b3887e9628990a75732ab74c Reviewed-on: https://chromium-review.googlesource.com/778320Reviewed-by:
-
Sylvestre Ledru authored
Bug: Change-Id: I553d6481a485a87c0246424270d63297400ceabe Reviewed-on: https://chromium-review.googlesource.com/579909Reviewed-by:
Yang Guo <yangguo@chromium.org> Reviewed-by:
-
jgruber authored
Bug: v8:7040 Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel Change-Id: I537b5d96e8d9275b695a3c56c57899e88b8b199d Reviewed-on: https://chromium-review.googlesource.com/776654 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
-
Benedikt Meurer authored
Now that Crankshaft is gone we no longer need to worry about parameter mismatch for safepoints and we can just tail-call to %GrowArrayElements from the GrowArrayElementsStub. Bug: chromium:608675, v8:5269, v8:6408 Change-Id: I1b11d7d00cad02749a0ebc0a7de5e608de6d91c9 Reviewed-on: https://chromium-review.googlesource.com/778861Reviewed-by:
-
Benedikt Meurer authored
The StringEqual builtin handles two byte strings already. Bug: v8:4913, v8:6365, v8:6371, v8:6936, v8:7022 Change-Id: I6f5a3999ccdce8e9bfcece6e94362c15183bbd8c Reviewed-on: https://chromium-review.googlesource.com/778883Reviewed-by:
-
Peter Marshall authored
For simple replacement strings without $ characters, we can do the replacement in CSA for a global regexp. This is a common case because this is currently the most widely used way to 'replaceAll' in a string. This CL speeds up the test case in the linked bug by 13%. Bug: v8:7053 Change-Id: I0d1d7c25fed07dfd7927191a3ef3138302e10c8f Reviewed-on: https://chromium-review.googlesource.com/774440 Commit-Queue: Peter Marshall <petermarshall@chromium.org> Reviewed-by:
-
Benedikt Meurer authored
The "array protector" now guards the Object.prototype, the Array.prototype and the String.prototype, so the name was a bit misleading nowadays. So the new name "no elements protector" was chosen. Bug: v8:6936, v8:7014, v8:7027 Change-Id: I9a9d7caa2caf0ac9e78cc6658de2f0506970dfa2 Reviewed-on: https://chromium-review.googlesource.com/778162Reviewed-by:
Camillo Bruni <cbruni@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#49471}
-
Benedikt Meurer authored
The ToBooleanHints were used to represent the ToBoolean feedback collected by Fullcodegen. But Ignition doesn't collect this feedback and also TurboFan doesn't make use of the hints, so we should remove this for now. Bug: v8:7101 Change-Id: Ifc97d3ebb7494029b33ad79fc8bafdf3c08fb871 Reviewed-on: https://chromium-review.googlesource.com/778163Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#49470}
-
- 19 Nov, 2017 3 commits
-
-
Yang Guo authored
R=mstarzinger@chromium.org Bug: v8:6593 Change-Id: Ica794c7b0d779f04647d2b2c5ce7762a537620ae Reviewed-on: https://chromium-review.googlesource.com/759793 Commit-Queue: Yang Guo <yangguo@chromium.org> Reviewed-by:
-
Yang Guo authored
Previously, in order to get immortal immovable objects onto the first page, the serializer would iterate the root list twice. The first time it would prioritize immortal immovables. The second time it would serialize the rest. This does not guarantee that immortal immovable objects actually end up on the first page, and by now this is not necessary anymore, since we mark all pages created during heap init as immortal immovable pages. R=mlippautz@chromium.org Change-Id: Ie95fcd779377a75337621ba862bc1a745ed5cbaa Reviewed-on: https://chromium-review.googlesource.com/768731 Commit-Queue: Yang Guo <yangguo@chromium.org> Reviewed-by:
-
v8-autoroll authored
Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/f2ca3e0..509676b TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org Change-Id: I5d6e78e23d83234c8c80eaef4a7c8a51c7575e6a Reviewed-on: https://chromium-review.googlesource.com/777929Reviewed-by:
v8 autoroll <v8-autoroll@chromium.org> Commit-Queue: v8 autoroll <v8-autoroll@chromium.org> Cr-Commit-Position: refs/heads/master@{#49467}
-
- 18 Nov, 2017 4 commits
-
-
Anna Henningsen authored
The existance of an `AllowJavascriptExecutionDebugOnly` scope in `Isolate::ReportPendingMessages()` indicates that the API supports running arbitrary JS code in a `AddMessageListener` callback. Currently, this can fail in debug mode: The `!isolate->external_caught_exception()` condition is checked when entering API methods inside such a handler. However, if there is a verbose `TryCatch` active when the exception occurs, this check fails, and when calling `ToString()` on the exception object leaves a pending exception itself, the flag is re-set to `true`. Fix this problem by clearing the flag and the pending exception if there was one during `ToString()`. This matches the code a few lines up in `messages.cc`, so the exception state is now consistent during the callback. This currently makes a Node.js test fail in debug mode (`parallel/test-error-reporting`). Bug: node:7144 Bug: node:17016 Change-Id: I060d00fea3e9a497f4df34c6ff8d6e29ebe96321 Reviewed-on: https://chromium-review.googlesource.com/718096 Commit-Queue: Yang Guo <yangguo@chromium.org> Reviewed-by:
-
v8-autoroll authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/5698e23..5718716 Rolling v8/buildtools: https://chromium.googlesource.com/chromium/buildtools/+log/3196d83..461b345 Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/fd88dfb..37921f1 Rolling v8/third_party/instrumented_libraries: https://chromium.googlesource.com/chromium/src/third_party/instrumented_libraries/+log/e07d437..ebf8d92 Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/e70074d..f2ca3e0 TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org Change-Id: Ib22ef3b367d667199b3c3b12c892a1f7b476d7a7 Reviewed-on: https://chromium-review.googlesource.com/777595Reviewed-by:
-
Camillo Bruni authored
- This precents us from logging two ICEvents for a megamorphic miss that adds a new property - We don't have to reset the profiler ticks anymore for this miss The particular case for missing to add a new property happens ~1700 times in the Speedometer Angular benchmark where we get an already internalized key as property name. Change-Id: I2362c3b7a66d9def1bc4295f6f1e64c96b25fe8a Reviewed-on: https://chromium-review.googlesource.com/777259 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#49464}
-
Adam Klein authored
Fixes instruction names to be all in one <td>, rather than being split between two due to miscalculation of op_offset. Change-Id: Ieef5d20c238c8e0a5b2316239324d375090006a1 Reviewed-on: https://chromium-review.googlesource.com/777761Reviewed-by:
-
- 17 Nov, 2017 14 commits
-
-
Jakob Kummerow authored
This CL creates the invariant that the BigInt class treats BigInt objects as immutable. Writing to new BigInt objects as part of their construction is done by the MutableBigInt helper class, which in turn is hidden as an implementation detail in bigint.cc. As a side effect, this refactoring enforces right-trimming checks for all newly created BigInts, and ensures that all BigInt allocations possibly exceeding kMaxLength check for this case and throw a RangeError instead of crashing. Bug: v8:6791 Tbr: mlippautz@chromium.org Change-Id: Id239746108e6b076b47a03ba37462001eb501507 Reviewed-on: https://chromium-review.googlesource.com/742329 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#49462}
-
Ulan Degenbaev authored
The layout descriptor helper computes the object header size using map->instance_size() and map->GetInObjectProperties(). It races with finalization of slack tracking, which changes both the instance size and the in-object properties count. This patch replaces the in-object properties count byte in the map with the byte that stores the start offset of in-object properties. The new byte can be used in the layout descriptor to compute the object header size and it is immutable. This patch also renames InstanceSize to InstanceSizeInWords where the instance size is represented in words. Bug: chromium:786069, chromium:694255 Change-Id: I4b48c6944d3fe8a950bd7b0ba43d75216b177a78 Reviewed-on: https://chromium-review.googlesource.com/776720 Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
-
Igor Sheludko authored
Class' prototype temporarily got properies backing store inconsistent with the map which obviously confused heap verifier. Bug: v8:5799 Change-Id: Ie28b0418daa657763d07c8a928851111680718ed Reviewed-on: https://chromium-review.googlesource.com/777560Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#49460}
-
Pierre Langlois authored
The logger for perf does not support relocating code objects so as a result we disable code space compacting to make sure code does not move. However, a a CodeMove event may still happen if a BytecodeArray object moves, which isn't relevant to the perf jit support so we can ignore it. Bug: Change-Id: Ie6acf58fe6adfb5cec2f8756f457134cf3b13c2a Reviewed-on: https://chromium-review.googlesource.com/759795Reviewed-by:
-
Leszek Swirski authored
Add another entry to the NoCacheReason enum, reporting that the chromium ScriptResource has no cache handler. Also, the amount of chromium-specific entries in this enum is getting too high. So, added a TODO for removing them -- possibly in the future we want to do this no-cache reason logging in Chromium after all, propagating isolate cache hits and consume failures back up the API with an out parameter. Bug: chromium:769203 Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng Change-Id: I63ca863cfef61e04e7104318eb79810796b61a9c Reviewed-on: https://chromium-review.googlesource.com/776893Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/master@{#49458}
-
Igor Sheludko authored
This CL also includes fixes for CF issues found while the previous reland was active. Bug: v8:5799, chromium:783902, chromium:783926, chromium:783822 Change-Id: I1f7d9b037d90838469c45f5d72771a77444c662e Reviewed-on: https://chromium-review.googlesource.com/764067Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Reviewed-by:
-
Michael Lippautz authored
Persistent handles are always independent these days. Users should mark weak handles as active using MarkActive if they want to keep weak handles that are otherwise unreachable alive across scavenges. Bug: chromium:780749 Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng Change-Id: I116e984ce14a035d1cef491d49f11a388fa8169d Reviewed-on: https://chromium-review.googlesource.com/759794 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
-
Adam Klein authored
This reverts commit 236298ac. Reason for revert: suspected cause of failures on GC stress bots: https://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/16341 https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/16269 Original change's description: > [wasm] Unify deoptimization data > > Add methods to add deoptimization data and use them from all the places > where we currently add them manually. Also add them to wasm-to-wasm > wrappers compiled on table set, which was missing before, leading to > the referenced bug. > > Drive-by: Disable non-applicable MaybeHandle constructors to allow > overloading functions with different Handle types. > > R=ahaas@chromium.org > > Bug: chromium:779292 > Change-Id: Ib9132d9faeb1092c46e22dd8196d201ce5c0942f > Reviewed-on: https://chromium-review.googlesource.com/774838 > Reviewed-by: Andreas Haas <ahaas@chromium.org> > Commit-Queue: Clemens Hammacher <clemensh@chromium.org> > Cr-Commit-Position: refs/heads/master@{#49452} TBR=ahaas@chromium.org,clemensh@chromium.org Change-Id: I02fb49d2ece8e04ac5fb26f618bfe6fb2f133d06 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: chromium:779292 Reviewed-on: https://chromium-review.googlesource.com/777079Reviewed-by:
Adam Klein <adamk@chromium.org> Commit-Queue: Adam Klein <adamk@chromium.org> Cr-Commit-Position: refs/heads/master@{#49455}
-
Jakob Gruber authored
This reverts commit 4d3bc552. Reason for revert: https://crbug.com/785778 Original change's description: > [coverage] add coverage for binary expressions > > Adds block-level coverage tracking for binary && and || > expressions. Introduces a BinaryOperation source-range > for tracking the operations themselves and an Expression > source-range, used for tracking NaryLogical expressions. > > This builds on work by jgruber@chromium.org in > the issue. > > TBR=marja@chromium.org > R=jgruber@chromium.org, rmcilroy@chromium.org > > Bug: v8:6660 > Change-Id: I83a81f13a3514a734c06948b2d3e91138fb00e18 > Reviewed-on: https://chromium-review.googlesource.com/754564 > Commit-Queue: Jakob Gruber <jgruber@chromium.org> > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > Cr-Commit-Position: refs/heads/master@{#49304} TBR=rmcilroy@chromium.org,marja@chromium.org,jgruber@chromium.org,ben@npmjs.com # Not skipping CQ checks because original CL landed > 1 day ago. Bug: v8:6660 Change-Id: Ie017c528604b2e01400f527511413eaea5786198 Reviewed-on: https://chromium-review.googlesource.com/776768Reviewed-by:
-
Adam Klein authored
Both of these features were shipped in Chrome 62. Bug: v8:4545, v8:6172 Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng Change-Id: Ie00dcbeded7517a15696d4a78fcfbbf162919923 Reviewed-on: https://chromium-review.googlesource.com/775601Reviewed-by:
-
Clemens Hammacher authored
Add methods to add deoptimization data and use them from all the places where we currently add them manually. Also add them to wasm-to-wasm wrappers compiled on table set, which was missing before, leading to the referenced bug. Drive-by: Disable non-applicable MaybeHandle constructors to allow overloading functions with different Handle types. R=ahaas@chromium.org Bug: chromium:779292 Change-Id: Ib9132d9faeb1092c46e22dd8196d201ce5c0942f Reviewed-on: https://chromium-review.googlesource.com/774838Reviewed-by:
Andreas Haas <ahaas@chromium.org> Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#49452}
-
Jakob Gruber authored
This test iterates all builtin objects; explicitly deserialize builtins when necessary to avoid verifying DeserializeLazy by accident. Bug: v8:6624 Change-Id: Iab3f708380809b7486ef11a2816e9593ee7e65cd Reviewed-on: https://chromium-review.googlesource.com/654902 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
-
Sergiy Byelozyorov authored
TBR=machenbach@chromium.org Bug: chromium:748057 No-Try: true Change-Id: I20a74823678510f343c865b074b2d088c1080b94 Reviewed-on: https://chromium-review.googlesource.com/776719 Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org> Reviewed-by:
-
Bill Budge authored
- Warn on unused result for OS Allocate, Free, SetPermissions, CommitRegion, UncommitRegion functions. - Adds CHECKS or DCHECK/USE around call sites. Bug: chromium:756050 Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng Change-Id: Ic00b0a42a1e09bdba013b7fa2b1b4e2b7591bac6 Reviewed-on: https://chromium-review.googlesource.com/769792Reviewed-by:
-
