1. 13 Feb, 2020 1 commit
    • Jakob Gruber's avatar
      Quick fix for array reduction tests · f4402716
      Jakob Gruber authored
      These tests are likely missing %PrepareFunctionForOptimization
      annotation of lambdas. Thus lambdas are no longer inlined and
      %DeoptimizeNow does nothing, while the entire point of these tests is
      to test deoptimization paths.
      
      Disabling lazy feedback allocation is a quick fix to restore coverage
      until we can land a more complete fix (for details see the linked
      bug).
      
      Bug: v8:10195
      Change-Id: I4038cdc5718230253ffb5bbc57d574342c652377
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2054096
      Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
      Auto-Submit: Jakob Gruber <jgruber@chromium.org>
      Reviewed-by: 's avatarTobias Tebbi <tebbi@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#66261}
      f4402716
  2. 19 Jun, 2019 1 commit
    • Simon Zünd's avatar
      Fix flaky Array#reduce mjsunit test · 6df0af84
      Simon Zünd authored
      This CL fixes a flaky mjsunit test, that exercises Array#reduce with
      sealed arrays in TurboFan. The flake was caused by temporary objects,
      whos maps didn't live long enough. The code object of the function
      under test holds weakly onto this maps. With a low enough gc interval,
      the maps, and thus the code object, get cleaned up before the
      {assertOptimized} can execute.
      
      The fix is simply to assign these temporary objects to variables.
      
      Bug: v8:9374
      Change-Id: I43da8ba6b0194872b176e27617d9ca7fbfe43ec2
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1666989
      Auto-Submit: Simon Zünd <szuend@chromium.org>
      Reviewed-by: 's avatarSigurd Schneider <sigurds@chromium.org>
      Commit-Queue: Simon Zünd <szuend@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#62269}
      6df0af84
  3. 18 Jun, 2019 1 commit
  4. 13 Jun, 2019 1 commit
  5. 04 Jun, 2019 1 commit
  6. 05 Mar, 2019 1 commit
    • Mike Stanton's avatar
      [Builtins] Array.prototype.reduce missing length check · 2222a9d6
      Mike Stanton authored
      In the recent port of reduce() and reduceRight(), a check for a length
      change during the loop (standard for iterating builtins) was omitted.
      
      We did get array bounds check protection, however it didn't expose
      the issue in our tests because the bounds check is against the
      backing store length, not against the length in the referring JSArray.
      
      Also added a test for reduceRight().
      
      R=jgruber@chromium.org
      
      Bug: chromium:937676
      Change-Id: I76e22e0d71965bff84a0822b1df5dc818a00b50e
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1503732Reviewed-by: 's avatarJakob Gruber <jgruber@chromium.org>
      Commit-Queue: Michael Stanton <mvstanton@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#60033}
      2222a9d6
  7. 05 Mar, 2018 1 commit
  8. 25 Jan, 2018 1 commit
  9. 19 Jan, 2018 1 commit
  10. 15 Jan, 2018 1 commit
  11. 21 Dec, 2017 2 commits
  12. 15 Sep, 2017 1 commit
  13. 21 Mar, 2017 1 commit
  14. 22 Oct, 2014 1 commit
  15. 27 Mar, 2014 1 commit
  16. 14 Nov, 2012 1 commit
  17. 31 May, 2011 1 commit
  18. 09 Jul, 2009 1 commit
  19. 21 Apr, 2009 2 commits