- 13 Dec, 2017 29 commits
-
-
Ulan Degenbaev authored
This ensures that MigrateFastToFast does not overflow the length of the property array. Bug: chromium:789393 Change-Id: I77adc319c1c8c469ea482bad35ead8661d535192 Reviewed-on: https://chromium-review.googlesource.com/824167 Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Reviewed-by:
Sathya Gunasekaran <gsathya@chromium.org> Cr-Commit-Position: refs/heads/master@{#50086}
-
Sergiy Byelozyorov authored
TBR=sergiyb@chromium.org Bug: chromium:747960 Change-Id: I4b28456f7a2809065ef8581a2440b87161996332 Reviewed-on: https://chromium-review.googlesource.com/824169 Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org> Reviewed-by:
Sergiy Byelozyorov <sergiyb@chromium.org> Cr-Commit-Position: refs/heads/master@{#50085}
-
Benedikt Meurer authored
The k value passed to NumberAdd was outside the integer range, which meant it had to choose Double as the only valid representation. The other array builtins pass the result of CheckBounds here to specifically force the types into integer range, which allows the representation selection to pick Word32 instead of Float64 representation. Drive-by-fix: Pass kind to AccessBuilder::ForJSArrayLength() as well. Bug: chromium:791045, v8:1956 Change-Id: I357e1ba0dc52be544e631e4d554ab772b9b4c9bb Reviewed-on: https://chromium-review.googlesource.com/823968Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#50084}
-
Sergiy Byelozyorov authored
TBR=machenbach@chromium.org No-Try: true Bug: chromium:747960 Change-Id: If7cb86066c7579a02b3cb56bb64084574fa4187d Reviewed-on: https://chromium-review.googlesource.com/824922 Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org> Reviewed-by:
-
Michael Starzinger authored
R=clemensh@chromium.org Change-Id: I80201b16c5d7a373ae5ff56bfafb46f4425bf997 Reviewed-on: https://chromium-review.googlesource.com/824243 Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by:
Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#50082}
-
Igor Sheludko authored
The dispatcher is responsible for handling stores to lexical environment variables and for storing directly to the JSGlobalObject. In the latter case the dispatcher also ensures that JSGlobalProxy is provided as a receiver if a setter function has to be called. Unlike StoreIC the calling convention for the StoreGlobalIC does not include receiver. Bug: v8:7206, chromium:576312, v8:5561 Change-Id: Ifa896c7b41bf440785b757c2272ec91211e79c98 Reviewed-on: https://chromium-review.googlesource.com/818965 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#50081}
-
Ulan Degenbaev authored
Revision 5bc1d291 introduced a bug in the case when the filler is in the unmapped region, which leads to CHECK failure. Change-Id: I013e4386f6d5e9cdad22c11e1a7a9f1a088375ae Reviewed-on: https://chromium-review.googlesource.com/823845Reviewed-by:
-
Michal Majewski authored
Bug: v8:6917 Change-Id: I88fdb12c39311531600c0715fff5abe5da051295 Reviewed-on: https://chromium-review.googlesource.com/824271 Commit-Queue: Michał Majewski <majeski@google.com> Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/master@{#50079}
-
Michal Majewski authored
Bug: v8:6917 Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng Change-Id: I5ca840db75766413659cb96fd28b922712040cec Reviewed-on: https://chromium-review.googlesource.com/823843 Commit-Queue: Michał Majewski <majeski@google.com> Reviewed-by:
-
Clemens Hammacher authored
So far we generated source positions and safepoint information, but we never actually attached it to the generated code objects. This CL adds that. R=titzer@chromium.org Bug: v8:6600, chromium:793694 Change-Id: I8f4c6d8752f4c31a1df51c4893c262ea5925f3b5 Reviewed-on: https://chromium-review.googlesource.com/824266Reviewed-by:
Ben Titzer <titzer@chromium.org> Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#50077}
-
Michal Majewski authored
- All testcase/testsuite/variant generator subclasses renamed to just TestCase/TestSuite/VariantGenerator since they're private implementation. - All `testcase` variables renamed to `test` to not conflict with a module name. - No more two statements in the same line. - Removed some unused testsuite methods. Bug: v8:6917 Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng Change-Id: I7710f3419f738a5f9ddca73765dd2cad2e35b952 Reviewed-on: https://chromium-review.googlesource.com/823964Reviewed-by:
-
Clemens Hammacher authored
The intel manual knows "short jumps", "near jumps" and "far jumps", where our Label::kNear corresponds to short jumps and Label::kFar corresponds to near jumps. Add some words to document this. R=mstarzinger@chromium.org Change-Id: I2b41cc770ee2c1fecff5e7363cede264ca3cd033 Reviewed-on: https://chromium-review.googlesource.com/824270Reviewed-by:
-
Michael Starzinger authored
This refactors the list of redirections of runtime call targets that simulators maintain to be process-wide (as opposed to be per Isolate). Such redirections are used for static C++ call targets which themselves are process-wide, which makes this model a closer fit. Access is already properly synchronized via a mutex. Along the way this also introduces the {SimulatorBase} class as a common base class for all simulator implementations. R=clemensh@chromium.org Change-Id: Iae8602c44b1b34cb916dde2b22c9403b0496b3d4 Reviewed-on: https://chromium-review.googlesource.com/823966 Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by: -
Ross McIlroy authored
RegisterLists should only be allocated via the register allocator. To ensure this, make the RegisterList constructor private and only expose it to tests and the BytecodeRegisterAllocator. Change-Id: I09ebfc5c0f1baecfb1333fd672b96d462fd26fcf Reviewed-on: https://chromium-review.googlesource.com/822196 Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
Mythri Alle <mythria@chromium.org> Cr-Commit-Position: refs/heads/master@{#50073}
-
Clemens Hammacher authored
LiftoffAssembler::ReserveStackSpace expected number of bytes, not number of stack slots. Also, make this clear in the naming of the parameter, and remove a dead field. R=titzer@chromium.org Bug: v8:6600 Change-Id: Ic4c7167cfa26a169b2936acdde865863141f441d Reviewed-on: https://chromium-review.googlesource.com/823967Reviewed-by:
-
Clemens Hammacher authored
We really just need one check instead of three. This also unifies the error message to be the same on 32 and 64 bit systems. Drive-by: Fix potential overflow in {validate_size}. R=titzer@chromium.org Bug: chromium:794353 Change-Id: I63c1f5ef53c1f245b9e82bcbf86a5d9ac0d2725e Reviewed-on: https://chromium-review.googlesource.com/824082Reviewed-by: -
Georgia Kouveli authored
This includes adding a padding slot to the stack handler, which is done for all architectures for consistency. Bug: v8:6644 Change-Id: I8a6379a82e2a9d1819069850b6734489bd6071a6 Reviewed-on: https://chromium-review.googlesource.com/822477Reviewed-by:
-
Sigurd Schneider authored
This disallows speculation after deoptimization from any of Array.{forEach,map,filter,find} due to CheckMap fails. Such CheckMap fails happen if the builtins' function argument causes the map of the array to change. The js-call-lowering refrains from optimizing builtins for which speculation was disallowed. Bug: v8:6898, v8:7127 Change-Id: Ied6696f8fb023ee404fb82e9d37bfb061f293854 Reviewed-on: https://chromium-review.googlesource.com/819354Reviewed-by: -
Clemens Hammacher authored
Add support for loading and storing i32 values to and from memory. Support for f32 and for non-traphandler configurations (i.e. emitting bounds checks) will be added in a follow-up CL. R=titzer@chromium.org Bug: v8:6600 Change-Id: I43c44ce61f5acbac325261212374eb0f48c6ee89 Reviewed-on: https://chromium-review.googlesource.com/809164Reviewed-by:
-
Tobias Tebbi authored
I also used the opportunity to clean up the loop peeler a bit by making the class stateful, to avoid passing long argument lists around. Bug: v8:5864 Change-Id: I2e034c6eabd381b01e15cf3e6aa3ce7b14e7b3d8 Reviewed-on: https://chromium-review.googlesource.com/822933 Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Reviewed-by:
-
Sigurd Schneider authored
For eager deopts within builtin stub frames we skiped marking the underlying function as deoptimized. This avoided deopt loops where we would just generate the same optimized code all over again. Bug: v8:6898 Change-Id: Ie3d7ee4dfcbeb63e6087112d5740a423c4730599 Reviewed-on: https://chromium-review.googlesource.com/822491Reviewed-by:
-
Michal Majewski authored
- create testcase subclass for each test - move get_command, get_source from suite to test - promises-aplus tests are broken - moving expected outcomes etc. is still in progress Bug: v8:6917 Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng Change-Id: I006e64ecf51dda95c41dff88c68b24f17a638566 Reviewed-on: https://chromium-review.googlesource.com/798331 Commit-Queue: Michał Majewski <majeski@google.com> Reviewed-by:
-
Sigurd Schneider authored
This CL adds support to the deoptimizer for setting the no speculation bit on a provided feedback vector if desired. Bug: v8:7127 Change-Id: I31fd1ea306cf5a4e919faeb896a83c1afdfccd63 Reviewed-on: https://chromium-review.googlesource.com/819370 Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#50064}
-
Michael Stanton authored
This reverts commit 7d699b93. Reason for revert: Actually we like the trampolines. Slight reduction in code size, and prevents spanning the icache. Original change's description: > [ICs] Eliminate trampoline ICs in TurboFan generic lowering > > Trampoline ICs differ from normal ICs only in that they > load the feedback vector from the stack instead of accepting it > as an argument. We created them for FullCodeGen, where you always > have the feedback vector on the stack, and can reduce the amount > of code required to invoke an ICs by hiding the stack load down > in the trampoline IC. > > Now the concept isn't really necessary, and we can achieve a > nice cleanup of our idea-space by removing it. The first step is > to remove their usage in TurboFan. > > Bug: v8:7199 > Change-Id: I08aefa5de199b1f19adea261b7086a84338c0805 > Reviewed-on: https://chromium-review.googlesource.com/822193 > Reviewed-by: Tobias Tebbi <tebbi@chromium.org> > Commit-Queue: Michael Stanton <mvstanton@chromium.org> > Cr-Commit-Position: refs/heads/master@{#50038} TBR=mvstanton@chromium.org,tebbi@chromium.org Change-Id: I63dcd98b799739d1d6ea55508b1ea5cfad9e3292 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:7199 Reviewed-on: https://chromium-review.googlesource.com/822420Reviewed-by:
Michael Stanton <mvstanton@chromium.org> Commit-Queue: Michael Stanton <mvstanton@chromium.org> Cr-Commit-Position: refs/heads/master@{#50063}
-
Sigurd Schneider authored
Bug: v8:7127 Change-Id: Iec65ead1540289aa99f496fd66595f2de88db68c Reviewed-on: https://chromium-review.googlesource.com/817417Reviewed-by:
-
peterwmwong authored
Bug: chromium:791045, v8:1956 Change-Id: I1400fc95b78e0f4771867d136377b14aed5bd4f4 Reviewed-on: https://chromium-review.googlesource.com/819510Reviewed-by:
-
v8-autoroll authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/e796de3..3d92234 Rolling v8/buildtools: https://chromium.googlesource.com/chromium/buildtools/+log/282996b..1be57dc Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/cb82b10..fbee132 TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org Change-Id: Iea76a8896a0e92c76bf334922be62a3c60c8fcaa Reviewed-on: https://chromium-review.googlesource.com/822305Reviewed-by:
v8 autoroll <v8-autoroll@chromium.org> Commit-Queue: v8 autoroll <v8-autoroll@chromium.org> Cr-Commit-Position: refs/heads/master@{#50060}
-
Alexei Filippov authored
BUG=v8:7202 TBR=mstarzinger@chromium.org Change-Id: I5399eab9a04edf98d57ee9e18be76e69f7cc9fa2 Reviewed-on: https://chromium-review.googlesource.com/823566Reviewed-by:
Alexei Filippov <alph@chromium.org> Commit-Queue: Alexei Filippov <alph@chromium.org> Cr-Commit-Position: refs/heads/master@{#50059}
-
Alexei Filippov authored
The new frame type is inteneded to represent native C++ stack frames. JS code may sometimes make calls to helper native functions that do not provide any special stack layout besides the return address and frame pointer. Currently the stack iterator bails out when it sees an unknown frame. The patch allows the iterator to unwind stacks having such frames. BUG=chromium:768540 Change-Id: I9c273c7015695a6733c0a0c52b522fca7b25de0d Reviewed-on: https://chromium-review.googlesource.com/794991 Commit-Queue: Alexei Filippov <alph@chromium.org> Reviewed-by:
-
- 12 Dec, 2017 11 commits
-
-
v8-autoroll authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/ca599b0..e796de3 Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/d624b3c..cb82b10 Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/8688d26..73924d8 TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org Change-Id: I28fc53da5f713100b3d93cdac5e8a2708f7c5a5f Reviewed-on: https://chromium-review.googlesource.com/821373Reviewed-by:
-
Sergiy Byelozyorov authored
TBR=sergiyb@chromium.org Bug: chromium:747960 Change-Id: Ib12ac093d1605ef4b409d8e73b0a75da83b2fb48 Reviewed-on: https://chromium-review.googlesource.com/817568 Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org> Reviewed-by:
-
Sergiy Byelozyorov authored
TBR=machenbach@chromium.org No-Try: true Bug: chromium:793687 Change-Id: I08f54c20ad50c3f733505ce0c6769cc08281beb7 Reviewed-on: https://chromium-review.googlesource.com/822613 Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org> Reviewed-by:
-
Clemens Hammacher authored
These enums capture the "type" of a load and store in one value, with accessors to get the value type, memory type, memory size etc. This will simplify implementing memory operations in Liftoff. R=titzer@chromium.org Bug: v8:6600 Change-Id: Ief673e90fe63292853f97e5e95b5c39da1296730 Reviewed-on: https://chromium-review.googlesource.com/822476 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
-
Tobias Tebbi authored
Turbofan does not always maintain source positions. Since the profiler is best-effort only, this is ok and we should not assert it. Source positions for stack traces are computed with an independent mechanism: the stack walker. It's impossible to use the stack walker here since it assumes that the frames actually exist. Bug: chromium:787959 Change-Id: I43c3c4e6de0a9b5f76b05c53af238cb1df6ea1c5 Reviewed-on: https://chromium-review.googlesource.com/822930Reviewed-by:
-
Ali Ijaz Sheikh authored
* DisableInlineAllocationSteps was a blunt hammer added to work around tests that needed to avoid artificially lower limits imposed by observers. PauseAllocationObserversScope can properly disable step on a temporary basis. * Modify tests. Remove DisableInlineAllocationSteps. This exposed a bug in allocation observers: we were not doing a step when a fresh page is added. Fix this by moving the step into UpdateAllocationInfo. We should be doing a step (and keeping top_on_previous_step_ consistent) whenever we move move top(). UpdateAllocationInfo is the correct place for this rather than the callers of UpdateAllocationInfo. Bug: Change-Id: I2edc238dc2e73bf9a2e9738c2a9b50efcac5cbf0 Reviewed-on: https://chromium-review.googlesource.com/821052 Commit-Queue: Ali Ijaz Sheikh <ofrobots@google.com> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#50052}
-
Marja Hölttä authored
If an initializer is a NaryOperation, its position ends up as a start position of a Scope, and a DCHECK used to fire. Interestingly, this was not caught by our existing tests. BUG=chromium:791256 Change-Id: Id47f850c7ad17ca580352f9bd56c9567b485c3b8 Reviewed-on: https://chromium-review.googlesource.com/822093Reviewed-by:
Adam Klein <adamk@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/master@{#50051}
-
Clemens Hammacher authored
This is a reland of fa18e78d. Mips compile error is fixed. Original change's description: > [wasm] [cleanup] Only pass information really needed > > Instead of always passing the MachineType, we can often just pass the > accessed memory size or the MachineRepresentation, which is less > information to pass and will simplify the upcoming refactoring for > memory operations in Liftoff. > > R=titzer@chromium.org > > Bug: v8:6600 > Change-Id: I8748f8e00dcfdbc4082893143fe88bdafde99053 > Reviewed-on: https://chromium-review.googlesource.com/822194 > Reviewed-by: Ben Titzer <titzer@chromium.org> > Commit-Queue: Clemens Hammacher <clemensh@chromium.org> > Cr-Commit-Position: refs/heads/master@{#50041} TBR=titzer@chromium.org Bug: v8:6600 Change-Id: I3dff3072d6ceebd74873ace0c7dce7cccc3055d5 Reviewed-on: https://chromium-review.googlesource.com/822851Reviewed-by:
-
Eugene Ostroukhov authored
This method is needed by some Blink agents to generate object previews. Bug: Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_chromium_rel_ng Change-Id: I2304a6e44ea65ec469f3a3216b8bed789f706d0c Reviewed-on: https://chromium-review.googlesource.com/821596Reviewed-by:
Aleksey Kozyatinskiy <kozyatinskiy@chromium.org> Reviewed-by:
Dmitry Gozman <dgozman@chromium.org> Commit-Queue: Eugene Ostroukhov <eostroukhov@chromium.org> Cr-Commit-Position: refs/heads/master@{#50049}
-
Clemens Hammacher authored
This reverts commit ee106cb9. Reason for revert: Still failing on big endian mips. Original change's description: > Reland "[wasm] [cleanup] Only pass information really needed" > > This is a reland of fa18e78d. > > Mips compile error is fixed. > > Original change's description: > > [wasm] [cleanup] Only pass information really needed > > > > Instead of always passing the MachineType, we can often just pass the > > accessed memory size or the MachineRepresentation, which is less > > information to pass and will simplify the upcoming refactoring for > > memory operations in Liftoff. > > > > R=titzer@chromium.org > > > > Bug: v8:6600 > > Change-Id: I8748f8e00dcfdbc4082893143fe88bdafde99053 > > Reviewed-on: https://chromium-review.googlesource.com/822194 > > Reviewed-by: Ben Titzer <titzer@chromium.org> > > Commit-Queue: Clemens Hammacher <clemensh@chromium.org> > > Cr-Commit-Position: refs/heads/master@{#50041} > > TBR=titzer@chromium.org > > Bug: v8:6600 > Change-Id: Ia2c47464277a7c7a70099e7f7d6e32003e34d87e > Reviewed-on: https://chromium-review.googlesource.com/822342 > Reviewed-by: Clemens Hammacher <clemensh@chromium.org> > Commit-Queue: Clemens Hammacher <clemensh@chromium.org> > Cr-Commit-Position: refs/heads/master@{#50047} TBR=titzer@chromium.org,clemensh@chromium.org Change-Id: I448e3ad433451fb468c2db66b4b297e8c72a8c69 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:6600 Reviewed-on: https://chromium-review.googlesource.com/822696Reviewed-by:
-
Clemens Hammacher authored
This is a reland of fa18e78d. Mips compile error is fixed. Original change's description: > [wasm] [cleanup] Only pass information really needed > > Instead of always passing the MachineType, we can often just pass the > accessed memory size or the MachineRepresentation, which is less > information to pass and will simplify the upcoming refactoring for > memory operations in Liftoff. > > R=titzer@chromium.org > > Bug: v8:6600 > Change-Id: I8748f8e00dcfdbc4082893143fe88bdafde99053 > Reviewed-on: https://chromium-review.googlesource.com/822194 > Reviewed-by: Ben Titzer <titzer@chromium.org> > Commit-Queue: Clemens Hammacher <clemensh@chromium.org> > Cr-Commit-Position: refs/heads/master@{#50041} TBR=titzer@chromium.org Bug: v8:6600 Change-Id: Ia2c47464277a7c7a70099e7f7d6e32003e34d87e Reviewed-on: https://chromium-review.googlesource.com/822342Reviewed-by:
-
