- 06 Feb, 2018 3 commits
-
-
Benedikt Meurer authored
The catch prediction logic got confused when we merged the reactions and result fields of JSPromise, because for settled promises it would start to treat the result as reactions list, leading to a crash most likely or memory corruption in the worst case (only if break on uncaught exception is enabled). We can only inspect reactions when the promise is still in "pending" state. Bug: chromium:808973, v8:7253 Change-Id: I15162c96fce959a052fbc628addd9418da39327c Reviewed-on: https://chromium-review.googlesource.com/903163Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#51106}
-
Clemens Hammacher authored
This adds support for the {i64.const} opcode. Since this makes i64 values show up on the wasm stack, quite some code paths need to handle them. The {CheckSupportedType} method still returns false for kWasmI64, which will be changed in a follow-up CL. That requires more changes since it unlocks more uses of i64, e.g. in loads and stores. R=titzer@chromium.org Bug: v8:6600 Change-Id: Ie012d0cd3db001f8693573fd16a3cfafe187009b Reviewed-on: https://chromium-review.googlesource.com/893319 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/master@{#51105}
-
v8-autoroll authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/508a6cd..ac54aef Rolling v8/buildtools: https://chromium.googlesource.com/chromium/buildtools/+log/f115f47..2637e7e Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/f601e51..6d0f862 Rolling v8/third_party/icu: https://chromium.googlesource.com/chromium/deps/icu/+log/c8ca296..d888fd2 TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org Change-Id: I3fa181e44ee42eeb562570b33035cde5e0d29dbe Reviewed-on: https://chromium-review.googlesource.com/902847Reviewed-by:
v8 autoroll <v8-autoroll@chromium.org> Commit-Queue: v8 autoroll <v8-autoroll@chromium.org> Cr-Commit-Position: refs/heads/master@{#51104}
-
- 05 Feb, 2018 17 commits
-
-
Michael Starzinger authored
R=clemensh@chromium.org TEST=mjsunit/regress/wasm/regress-808012 BUG=chromium:808012 Change-Id: Ia1e4527c6c845ffd01ecf5c7fa13b8b484d6ef6e Reviewed-on: https://chromium-review.googlesource.com/899122 Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by:
Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#51103}
-
Junliang Yan authored
R=joransiu@ca.ibm.com Change-Id: Iabba5eb2cbd941ace02951995d727196763d1aca Reviewed-on: https://chromium-review.googlesource.com/902363Reviewed-by:
Joran Siu <joransiu@ca.ibm.com> Commit-Queue: Junliang Yan <jyan@ca.ibm.com> Cr-Commit-Position: refs/heads/master@{#51102}
-
Ali Ijaz Sheikh authored
Bug: v8:7407 Change-Id: Icb13921872a9e41dced3ae95ff37ddf72ae30568 Reviewed-on: https://chromium-review.googlesource.com/902009Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Commit-Queue: Ali Ijaz Sheikh <ofrobots@google.com> Cr-Commit-Position: refs/heads/master@{#51101}
-
sreten.kovacevic authored
Previous implementation used delay slot the wrong way. Also, trampoline pools were not generated as they should. MIPS64 changed to be the same as MIPS since there is probably same problem that is masked. test=wasm-spec-tests/tests/br_table Change-Id: I94786233714a4a2f5eb86e74e02b7e7a7328bf2b Reviewed-on: https://chromium-review.googlesource.com/901883Reviewed-by:
Ivica Bogosavljevic <ivica.bogosavljevic@mips.com> Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com> Cr-Commit-Position: refs/heads/master@{#51100}
-
Choongwoo Han authored
Bug: chromium:808980 Change-Id: I7a89c6e30f473821f676fd5771365103072c78f1 Reviewed-on: https://chromium-review.googlesource.com/901306Reviewed-by:
-
Dan Elphick authored
Modify "run_perf.py --filter Array/" so that it will let match "Array" but not "ArrayLiteralSpread". Previously --filter Array/ would match nothing. Change-Id: I1f9c677e3558fc2256a71306af5fc1a8394ac698 Reviewed-on: https://chromium-review.googlesource.com/895453 Commit-Queue: Dan Elphick <delphick@chromium.org> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#51098}
-
kschimpf authored
Fixes float to I64 tests to not have duplicated tests. Also changes the use of macro REQUIRE to only be needed when an opcode (i.e. operation) is not supported on some architecture. Bug: v8:7226 Change-Id: I6c18602bd836469077808c0b3c93732af7c8f0d8 Reviewed-on: https://chromium-review.googlesource.com/895408 Commit-Queue: Karl Schimpf <kschimpf@chromium.org> Reviewed-by:
-
Yang Guo authored
Patch by Rumeet Dhindsa <rdhindsa@google.com>. R=jkummerow@chromium.org Change-Id: Ibff1af58bbdae52c6fb24b3d98d25e52cee0b63c Reviewed-on: https://chromium-review.googlesource.com/899006 Commit-Queue: Yang Guo <yangguo@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#51096}
-
Andreas Haas authored
The test required a special runtime function, which did not work in general but only in the context of that one test. After an offline discussion we decided that what the test is testing is not worth a runtime function, since we would also see in other tests if something goes wrong. R=clemensh@chromium.org Bug: v8:7403 Change-Id: I129a189a9df299d409a4a555eae28783e47b97d1 Reviewed-on: https://chromium-review.googlesource.com/901284Reviewed-by:
-
Georg Neis authored
Also slightly restructure if-chain for readability. Bug: Change-Id: I1903106f412e559536bac3369610f40fa6b58680 Reviewed-on: https://chromium-review.googlesource.com/901502Reviewed-by:
Michael Stanton <mvstanton@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#51094}
-
jgruber authored
Bug: v8:6666 Change-Id: I8de39b6ce31b59e5a76267cb665d42f758309c2a Reviewed-on: https://chromium-review.googlesource.com/897530Reviewed-by:
Franziska Hinkelmann <franzih@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#51093}
-
Pierre Langlois authored
A previous CL lowered NumberConstant nodes into IntPtrConstant nodes during simplified lowering. It inadvertently disabled an optimization in TypeArray accesses that relied on matching NumberConstant(0). Bug: chromium:806727 Change-Id: If1938af057be66dea8edc588cc048a01410ca0ad Reviewed-on: https://chromium-review.googlesource.com/897494Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Pierre Langlois <pierre.langlois@arm.com> Cr-Commit-Position: refs/heads/master@{#51092}
-
Franziska Hinkelmann authored
Change-Id: Ia1289985fa715ce4de66bec91675279c203afa36 Reviewed-on: https://chromium-review.googlesource.com/897811Reviewed-by:
Peter Marshall <petermarshall@chromium.org> Reviewed-by:
-
Michael Achenbach authored
This reverts commit 8e9eba36. Reason for revert: https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20noi18n%20-%20debug/builds/18887 Original change's description: > [regexp] fix Latin1 ignore-case bug. > > R=jgruber@chromium.org > > Bug: v8:6703 > Change-Id: I6b251191cc00d9ac8db41b91b528c130d1b23fc6 > Reviewed-on: https://chromium-review.googlesource.com/897523 > Commit-Queue: Yang Guo <yangguo@chromium.org> > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > Cr-Commit-Position: refs/heads/master@{#51088} TBR=yangguo@chromium.org,jgruber@chromium.org Change-Id: I09138cedb2631640709ec717045247362f653cb2 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:6703 Reviewed-on: https://chromium-review.googlesource.com/901184Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/master@{#51090}
-
Andreas Haas authored
The multi-return fuzzer was able to generate more than 256 parameters of the same type. However, the fuzzer itself could not deal with so many parameters. With this change more than 256 parameters of the same type can be handled and tested. R=clemensh@chromium.org Bug: chromium:807862 Change-Id: I6941eb0ff7e78a8feebc437624fa100adeda4e3d Reviewed-on: https://chromium-review.googlesource.com/897673Reviewed-by:
-
Yang Guo authored
R=jgruber@chromium.org Bug: v8:6703 Change-Id: I6b251191cc00d9ac8db41b91b528c130d1b23fc6 Reviewed-on: https://chromium-review.googlesource.com/897523 Commit-Queue: Yang Guo <yangguo@chromium.org> Reviewed-by:
-
jing.bao authored
Change-Id: If796c837c621053a61008793c0a51f3138047ebb Reviewed-on: https://chromium-review.googlesource.com/898568Reviewed-by:
Bill Budge <bbudge@chromium.org> Reviewed-by:
-
- 04 Feb, 2018 2 commits
-
-
Michael Achenbach authored
TBR=gsathya@chromium.org Bug: v8:7404 Change-Id: I6833be4480841f2f6f487ba3992d505bdf94a45c Reviewed-on: https://chromium-review.googlesource.com/900802Reviewed-by:
-
Benedikt Meurer authored
This adds a new isolate wide Promise#then protector, which guards the "then" lookup for all JSPromise instances whose [[Prototype]] is the initial %PromisePrototype%. Thus arbitrary mutations to the Promise.prototype (i.e. monkey-patching other methods or installing new functions) no longer sent you down the slow-path. Use this protector in Promise.prototype.catch and in Promise.resolve. Drive-by-fix: Restructure the resolve logic a bit and avoid the expensive and large SameValue check, which can be turned into a simple reference equal, as the promise in there is known to be a JSPromise anyways. Bug: v8:7253 Change-Id: If68b12c6bc6ca9c4d10552ae84854ebc3b5774f9 Reviewed-on: https://chromium-review.googlesource.com/899302 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Sathya Gunasekaran <gsathya@chromium.org> Reviewed-by:
-
- 03 Feb, 2018 3 commits
-
-
Michal Majewski authored
Bug: v8:6917 Change-Id: I4267900b6beed44eeae3df9b3b7a3e58402d6e6e Reviewed-on: https://chromium-review.googlesource.com/899366 Commit-Queue: Michael Achenbach <machenbach@chromium.org> Reviewed-by:
-
v8-autoroll authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/5aa28c4..508a6cd Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/744dac9..f601e51 TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org Change-Id: I57fe17f1d7d9e6b72e422068bb280910fb6f2c06 Reviewed-on: https://chromium-review.googlesource.com/900249 Commit-Queue: v8 autoroll <v8-autoroll@chromium.org> Reviewed-by:
-
Sathya Gunasekaran authored
Report an error during scope analysis if we're unable to find a variable proxy for the given private field. This can happen if we try to access a private field that was not defined or if we're outside the class scope. This doesn't correctly throw an early error when pre parsing a top level function because we don't track it's variables. Bug: v8:5368 Change-Id: I0a1193fe0ae213c0732fae5d435e150852a8d87d Reviewed-on: https://chromium-review.googlesource.com/892093Reviewed-by:
Adam Klein <adamk@chromium.org> Reviewed-by:
Yang Guo <yangguo@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org> Cr-Commit-Position: refs/heads/master@{#51082}
-
- 02 Feb, 2018 15 commits
-
-
Adam Klein authored
The code was using the "correct" cache key for lookups, but not for creating new entries, leading to us never hitting the cache for some Function-constructor cases. Bug: v8:4958, chromium:801556, chromium:802400, chromium:807192 Change-Id: I4ac2234b97a9f5f71957ef936dc4b588d020916b Reviewed-on: https://chromium-review.googlesource.com/898096Reviewed-by:
-
Pierre Langlois authored
Remove hard-coded scratch registers (r9 and ip) from the code generator in favor of using the `UseScratchRegisterScope` utility. And as a result, we can free the r9 register for the allocator to use. Note that the code generator now has to cope with a single scratch register (ip) instead of two (ip + r9). Therefore the code sequences emitted by moves aren't as optimized as they used to be. For instance, we now use a scratch S register in places where we could use r9. We can optimize them further if we want but running benchmarks showed no impact so keeping the code simpler was deemed better for the time being. Bug: v8:6553 Change-Id: I7fcf244cb1b6578564b503619a041006eaf74626 Reviewed-on: https://chromium-review.googlesource.com/895461 Commit-Queue: Pierre Langlois <pierre.langlois@arm.com> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Reviewed-by:
-
jgruber authored
This check verifies that all .h files in the src/ directory have an include guard of the form #ifndef V8_PATH_TO_FILE_H_ #define V8_PATH_TO_FILE_H_ // ... #endif // V8_PATH_TO_FILE_H_ The check can be skipped with a magic comment: // PRESUBMIT_INTENTIONALLY_MISSING_INCLUDE_GUARD Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng;master.tryserver.blink:linux_trusty_blink_rel Change-Id: I0a7b96abec289ad60f64ba8418f1892a6969596d Reviewed-on: https://chromium-review.googlesource.com/897487Reviewed-by:
Aleksey Kozyatinskiy <kozyatinskiy@chromium.org> Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Reviewed-by:
-
Caitlin Potter authored
A version of the spec change from https://github.com/tc39/ecma262/pull/988, but applied to the Async-from-Sync iterator type. This change does not modify generated bytecode (but maybe it should to take advantage of load IC feedback for loading "next"). Doing this grows bytecode by quite a bit, since it's necessary to throw-if-not-an-object before loading "next" (which currently gets to live in a code stub instead). BUG=v8:5855 Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng Change-Id: I0d2affef664d1069b24c54a553d62e17b49e5a16 Reviewed-on: https://chromium-review.googlesource.com/723136 Commit-Queue: Caitlin Potter <caitp@igalia.com> Reviewed-by:
-
Junliang Yan authored
Port ca1d44e3 Original Commit Message: If enabled, this mode moves code for isolate-independent builtins off the JS heap at Isolate creation. The Code object itself is rewritten to tail-call the off-heap instruction stream. R=jgruber@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com BUG= LOG=N Change-Id: Ia1b14663c17308101ce5e952fd508c891a098f8d Reviewed-on: https://chromium-review.googlesource.com/899105Reviewed-by:
-
Leszek Swirski authored
Special case script logging to also log the source of the script, even if that source is off-heap in an external string. Bug: v8:7266 Change-Id: I0d35f94f7b27d0d793d1a1a3fb8d3280960b253d Reviewed-on: https://chromium-review.googlesource.com/899344 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/master@{#51076}
-
jgruber authored
This is a reland of ef06fede. Original change's description: > Reland "[builtins] Add .incbin cctest" > > This is a reland of b0128161. > > Original change's description: > > [builtins] Add .incbin cctest > > > > Just to ensure this is portable across all platforms. > > > > Credits go to https://github.com/graphitemaster/incbin, bits of the > > .incbin code were taken from there. Thanks! > > > > Reland of https://crrev.com/c/881181 > > > > Bug: v8:6666 > > Change-Id: I5c0dbf56b1c987fd88607dca69b39d65b59cdefc > > Reviewed-on: https://chromium-review.googlesource.com/895597 > > Commit-Queue: Jakob Gruber <jgruber@chromium.org> > > Reviewed-by: Michael Achenbach <machenbach@chromium.org> > > Cr-Commit-Position: refs/heads/master@{#51042} > > Cq-Include-Trybots: luci.v8.try:v8_win64_msvc_compile_rel > Bug: v8:6666 > Change-Id: I8fc0963e28996a84ed56c2e740d895e26611abf0 > Reviewed-on: https://chromium-review.googlesource.com/897630 > Commit-Queue: Jakob Gruber <jgruber@chromium.org> > Reviewed-by: Michael Achenbach <machenbach@chromium.org> > Cr-Commit-Position: refs/heads/master@{#51054} Bug: v8:6666 Change-Id: Icc6816e260dac2d8b8f6c9c4a2725b271dac4664 Cq-Include-Trybots: luci.v8.try:v8_win64_msvc_compile_rel;master.tryserver.chromium.linux:linux_chromium_rel_ng Reviewed-on: https://chromium-review.googlesource.com/898927 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
-
Junliang Yan authored
These 2 test have known issues Change-Id: I4830e0af0f4f1cf7fd1189316356dd1f7dc2c6eb Reviewed-on: https://chromium-review.googlesource.com/896721Reviewed-by:
-
Gabriel Charette authored
Copied as-is modulo compile tweaks from Chromium's base. Copied tests highlighting existing overflow issues with V8's impl... TimeDelta::Max() will initially be used in V8 to flag events that never triggered in a TimedHistogram. Also constexpr'ed a few things while I was in there, it's harmless at worst and helps a little at best. Ideally would constexpr all the Time*::From*() methods like in Chromium but that has inlining implications and I don't know the impact that could have on V8. Bug: chromium:807606 Change-Id: If5aa92759d985be070e12af4dd20f0159169048b Reviewed-on: https://chromium-review.googlesource.com/899342Reviewed-by:
Hannes Payer <hpayer@chromium.org> Commit-Queue: Gabriel Charette <gab@chromium.org> Cr-Commit-Position: refs/heads/master@{#51073}
-
Ulan Degenbaev authored
It was accidentally added to debug-only flags. Change-Id: I329d23da5dc31186c27d43eedb021202d2694216 Reviewed-on: https://chromium-review.googlesource.com/899009Reviewed-by:
-
Benedikt Meurer authored
This creates a uniform PerformPromiseThen builtin, which performs the operation with the same name from the spec, except that it expects the handlers to be either undefined or callable already, since this is only relevant for a single callsite (namely Promise.prototype.then). Introduce a matching operator JSPerformPromiseThen into TurboFan, which represents this operation and removes the additional checks in case of Promise.prototype.then based on the information we can derived from the receiver maps. This yields a nice 20-25% improvement on Promise.prototype.then, as illustrated by the following micro-benchmark ```js const N = 1e7; function inc(x) { return x + 1; } function chain(promise) { return promise.then(inc).then(value => { if (value < N) chain(Promise.resolve(value)); }); } console.time('total'); chain(Promise.resolve(0)); setTimeout(console.timeEnd.bind(console, 'total')); ``` which goes from around 1230ms to 930ms with this patch. Bug: v8:7253 Change-Id: I5712a863acdbe7da3bb8e621887c7b952148c51a Reviewed-on: https://chromium-review.googlesource.com/899064Reviewed-by: -
Michael Achenbach authored
TBR=sergiyb@chromium.org NOTRY=true Bug: v8:6917 Change-Id: Ie585754c84f42cd864ab3b161a1ae27f7c2d2ab5 Reviewed-on: https://chromium-review.googlesource.com/899303Reviewed-by:
Sergiy Byelozyorov <sergiyb@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/master@{#51070}
-
Michael Achenbach authored
All tests are sensitive to internal state, which is incompatible with GC fuzzing. TBR=ulan@chromium.org NOTRY=true Bug: v8:7360 Change-Id: I4b28f40e099b7395e39725aaf6e9e199939ebd9f Reviewed-on: https://chromium-review.googlesource.com/899087 Commit-Queue: Michael Achenbach <machenbach@chromium.org> Reviewed-by:
-
Franziska Hinkelmann authored
Change-Id: Ibda6dc025e9a1584480154fba63ecf3c7b51394b Reviewed-on: https://chromium-review.googlesource.com/897765Reviewed-by:
-
Leszek Swirski authored
Record the various types of feedback vector slot separately, to estimate the relative impact of e.g. load ICs vs call ICs. Also, log the unused (i.e. uninitialized or premonomorphic) ones separately. Bug: v8:7266 Change-Id: Ie035cf48969e39f7156dfe523fd9218749b95cfe Reviewed-on: https://chromium-review.googlesource.com/897813 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
-
