- 20 Aug, 2019 37 commits
-
-
Leszek Swirski authored
Since the mutability of HeapNumbers is determined by their owning object's descriptor array, we can remove the MutableHeapNumber type entirely, at the cost of a few fewer DCHECKs and a couple of TODOs to use the descriptor array information. This is a necessary step towards a follow-up which allows in-place Double -> Tagged transitions Design doc: https://docs.google.com/document/d/1VeKIskAakxQFnUBNkhBmVswgR7Vk6T1kAyKRLhqerb4/ Bug: v8:9606 Change-Id: I13209f9c86f1f204088f6fd80089e17d956b4a50 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1743972 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#63294}
-
Sathya Gunasekaran authored
Previously, without support for converting strings to numbers we'd switch to megamorphic state and go to the runtime always to do the conversion causing a performance cliff. This patch improves the following js-perf-test scores: Object-Lookup-String-Constant-BytecodeHandler: 4.25% Object-Lookup-Index-String-BytecodeHandler: 5.41% Bug: v8:9449 Change-Id: I63787fa84373fc946f1304b0141e48a52a1b4bcb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1690953Reviewed-by:
Igor Sheludko <ishell@chromium.org> Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org> Cr-Commit-Position: refs/heads/master@{#63293}
-
Ng Zhi An authored
Bug: v8:9528 Change-Id: I7df27c3ee949a4c44fa0f78cfded6d8c34575e6b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1754445Reviewed-by:
Georg Neis <neis@chromium.org> Commit-Queue: Zhi An Ng <zhin@chromium.org> Cr-Commit-Position: refs/heads/master@{#63292}
-
Maya Lekova authored
ReduceTypedArrayPrototypeToStringTag, ReduceObjectGetPrototype and ReduceObjectGetPrototype are now heap-access free. Bug: v8:7790 Change-Id: If7f7ae4c7712326240aa50e02189fee94a57afa9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762022 Commit-Queue: Maya Lekova <mslekova@chromium.org> Reviewed-by:
-
Dan Elphick authored
5th attempt to reland now that crash with cpu profiler combined with code caching is fixed. Bug: v8:8510 Change-Id: I3489150a5067c41c36a4b468e412f9398a55135d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762293Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Commit-Queue: Dan Elphick <delphick@chromium.org> Cr-Commit-Position: refs/heads/master@{#63290}
-
Michael Lippautz authored
TracedGlobal is already cleared by V8 during garbage collections. It's the embedders responsibility to clear the reference if it destroys the underlying reference through other means. Allow embedders to specify whether they want TracedGlobal to execute clear on destruction via TracedGlobalTrait. Bug: chromium:995684 Change-Id: Ieb10cf21f95eb97e01eff15d4fbd83538f17cf7c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762007 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
-
Santiago Aboy Solanes authored
Follow-up CL that TNodifies loads from AnyTagged to TaggedPointer in interpreter-generator.cc for: * DescriptorArray::kEnumCacheOffset * EnumCache::kKeysOffset * EnumCache::kIndicesOffset * JSFunction::kSharedFunctionInfoOffset * JSGeneratorObject::kParametersAndRegistersOffset * JSGeneratorObject::kContextOffset * SourceTextModule::kRegularExportsOffset * SourceTextModule::kRegularImportsOffset Bug: v8:6949, v8:9396 Change-Id: I559d2a5ea353fbd9e1f539f30ce981d70d93714f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1752858 Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Reviewed-by:
-
Mathias Bynens authored
This feature shipped in V8 v7.4: https://v8.dev/blog/v8-release-74#faster-calls-with-arguments-mismatch Bug: v8:8895 Change-Id: I55c50aeda6c61d07b37987404ea09266c9f66702 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762026Reviewed-by:
Sathya Gunasekaran <gsathya@chromium.org> Commit-Queue: Mathias Bynens <mathias@chromium.org> Cr-Commit-Position: refs/heads/master@{#63287}
-
Dan Elphick authored
When deserializing from a code snapshot with logging enabled (e.g. when profiling) then this ensures source positions are collected before creating code events that need them. Bug: chromium:994673, v8:9504 Change-Id: Iad7644e983d3004c4889615cf2104dc4ef40da46 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762023Reviewed-by:
-
Seth Brenith authored
Extend the order-independent annotation parsing logic to include the following forms: @foo // bare annotation (already supported) @foo(0x70) // decimal literal @foo(HI) // identifier @foo("hello there") // quoted string This is obviously still pretty far from annotations in other languages, which usually support arbitrary expressions and multiple parameters, but I think it's sufficient to cover a pretty good variety of usages. The existing class-field annotations @if and @ifnot are reimplemented in the new style, meaning they could now appear in any order relative to other annotations on the same field (and can be repeated, though I doubt it would be of much use to anybody). Change-Id: I97b7c0c9a541ca3126b5ae3a2484688b04dda9f4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1754947 Commit-Queue: Seth Brenith <seth.brenith@microsoft.com> Reviewed-by:Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#63285}
-
Joyee Cheung authored
This patch implements the declaration of private accessors. When iterating over the class properties, we track private accessors associated with the same name in a ZoneHashMap. Once we get to all the necessary components for a private name (we know statically whether we should expect only a setter, only a getter, or both), we emit a call to a runtime function `CreatePrivateAccessors` that creates an AccessorPair, and store the components in it. The AccessorPair is then associated with the private name variable and stored in the context for later retrieval when the private accessors are accessed. Design doc: https://docs.google.com/document/d/10W4begYfs7lmldSqBoQBBt_BKamgT8igqxF9u50RGrI/edit Bug: v8:8330 Change-Id: Ie6d3882507d143b1f645d7ae82b21b7358656e89 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1725670 Commit-Queue: Joyee Cheung <joyee@igalia.com> Reviewed-by:
-
Dan Elphick authored
Fixes bytecode mismatch between lazy and non-lazy where "this" was marked as maybe assigned in constructors that called the super constructor. Since this will return the hole in cases where it was not yet initialized by super (and the hole is explicitly handled by JSContextSpecialization::ReduceJSLoadContext), it's safe to treat it as a constant in all cases. In the case of lazy compilation case, "this" is never added to the ScopeInfo so is never seen as mutable. Bug: chromium:994719 Change-Id: I43478fbc626b19eb1533aa9dec61b7f276ae140b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762025 Commit-Queue: Dan Elphick <delphick@chromium.org> Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/master@{#63283}
-
Dominik Inführ authored
Do not pass it as argument to CreateObjectFillerAt and remove the enum. Bug: v8:9454 Change-Id: Iafa37acbfea73d3cabb1732dbec0944db859fac2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762017Reviewed-by:
Peter Marshall <petermarshall@chromium.org> Reviewed-by:
-
Keno Fischer authored
Before dd6f4d4f, this function was reading a single u8 and verifying that it was 0x00. The referenced commit dropped this check as part of implementing decoding for table.get, but neglected to change the read type to u32v, which is the specified type of this immediate. Fix that. R=ahaas@chromium.org, titzer@chromium.org Change-Id: Ic2ce795023ec57be2c95aa79e62d3ccd1aa9c43c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1747178 Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by:
Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/master@{#63281}
-
Jakob Kummerow authored
This just adds the upstream tests; our implementation already had support. Change-Id: If8d340ebe79eae65d12164a01883482d521b8451 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762287Reviewed-by:
-
Jakob Gruber authored
The deoptimizer calculates frame layout based on the translation's `height` field, together with additional data (e.g.: are we looking at the topmost frame? what kind of deopt are we in?). The result is the final deoptimized frame size in bytes, together with a bunch of intermediate results such as the variable frame size (= without the fixed-size portion). In order to consider the deoptimized frame size in optimized stack checks, we will need to calculate the frame layout during compilation in addition to what we currently do during deoptimization. This CL moves in that direction by extracting relevant parts of frame layout calculation into classes that can be reused by both compiler and deoptimizer. These helpers will support both precise and conservative modes; the deoptimizer will use the precise mode (since it has full information), while the instruction selector will use the conservative mode. Bug: v8:9534 Change-Id: I93d6c39f10d251733f4625d3cc161b2010652d02 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1760825 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#63279}
-
Georg Neis authored
... at graph building time already, just like we do for other property accesses. Bug: v8:7790 Change-Id: I7ffc8ee4fb1df91fc59271edd7b70c14f531330a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762018Reviewed-by:
Maya Lekova <mslekova@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#63278}
-
Igor Sheludko authored
... to prepare for merging this back to stable channel. Bug: chromium:992914 Change-Id: Icbb257b5c02417d9222e60346575567360376264 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762021Reviewed-by:
-
Michael Starzinger authored
This adds type reflection support to the {WebAssembly.Module.exports} as well as {WebAssembly.Module.imports} method. It also refactors existing reflective code to use the internal instead of the public embedder API, which is slightly more efficient anyways. R=ahaas@chromium.org TEST=mjsunit/wasm/type-reflection BUG=v8:7742 Change-Id: I168741d382373ec47ebe0517ce7803732cbb3b24 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762011 Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by: -
Santiago Aboy Solanes authored
When TNodifying LoadMap, I went did a proper LoadObjectField<Map> and removed UncheckedCast. However, TNodification makes some code objects too big, as in Large code objects. This makes the x64 no embed bot green again. Bug: v8:9637 Change-Id: I5cb36834d7134c459ff2e2f11a852dd8c8ba5d94 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762015 Auto-Submit: Santiago Aboy Solanes <solanes@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Reviewed-by:
-
Santiago Aboy Solanes authored
This is a CL in a string of CLs that aims to TNodify CSA. In particular, there were some loads that were done in AnyTagged instead of TaggedPointer. TNode-ifying them brings improvement in pointer compression since we are able to decompress using the Pointer decompression. Bug: v8:6949, v8:9396 Change-Id: I368d4f85348f3560a7f71bf66ebc7c4dd978a8dd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1752854Reviewed-by:
-
Michael Starzinger authored
This adds type reflection support to the {WebAssembly.Module.exports} as well as {WebAssembly.Module.imports} method. It also refactors existing reflective code to use the internal instead of the public embedder API, which is slightly more efficient anyways. R=ahaas@chromium.org TEST=mjsunit/wasm/type-reflection BUG=v8:7742 Change-Id: I5f20ea57261f6433b8d86f55054216bf96b41382 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1760826 Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by: -
Joshua Litt authored
Implements match indices for regexp, as specified by https://github.com/tc39/proposal-regexp-match-indices, a stage 3 TC39 proposal. This implementation is hidden behind the '--harmony-regexp-match-indices' flag. Regexp match indices extends the JSRegExpResult object with an array of indices of matches, as well as a dictionary of capture names to match indices. Bug: v8:9548 Change-Id: I9866a2d1f5af6a507de710357cb5e74c694e7558 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1734937 Commit-Queue: Joshua Litt <joshualitt@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Adam Klein <adamk@chromium.org> Cr-Commit-Position: refs/heads/master@{#63272}
-
Dominik Inführ authored
Immediately remove recorded old-to-new slots when shrinking objects. This operation needs to drain the store buffer, however the store buffer is supposed to be removed anyway. Also do not remove slots when left-trimming since this isn't needed for correctness. Bug: v8:9454 Change-Id: I751baf2dcd03c87aee9cb1ebd168e05bf373a738 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762012Reviewed-by:
-
Maya Lekova authored
Bug: v8:7790 Change-Id: I2b9971b7944837a5a6943e401b8c9d91f25c515e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762016Reviewed-by:
-
Georg Neis authored
This brings the graph builder in sync with the serializer (and exponentiation in sync with the other binary operators). Bug: chromium:995430, v8:7790 Change-Id: I809b6f3756f75392cdc6747f8bcee8cdf0ee0f74 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762013 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
-
Georg Neis authored
... by making the operator have a control output, since we could deopt after my last change. Bug: chromium:995562, v8:7790 Change-Id: Ibc8c44708b4d43c4b2c3dfab2fd8fdf79c7ea671 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762010 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
-
Santiago Aboy Solanes authored
They were timeouting, e.g https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20-%20arm64%20-%20sim%20-%20pointer%20compression/2193 Change-Id: Icf3fcde15510cbdefcd2da8e66530c589f4423f1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762008 Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Commit-Queue: Maya Lekova <mslekova@chromium.org> Auto-Submit: Santiago Aboy Solanes <solanes@chromium.org> Reviewed-by:
-
Leszek Swirski authored
Chromium has checks which don't like static initializers in binaries, which fires on effect_control_linearizer.cc. We can remove these by making kMinusZeroBits (and family) constexpr, but to do this we have to avoid bit_cast. Instead, set the correct bit pattern manually (thankfully IEEE 754 0.0 is just zero bits, and -0.0 is 0.0 with a set sign bit). Change-Id: If1695ff715ad8f821e956757f8f9f7c850895011 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762009 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Reviewed-by:
-
Maya Lekova authored
Bug: v8:7790 Change-Id: I6f493d994f49d84020966322d60061567b54c854 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1760808 Commit-Queue: Maya Lekova <mslekova@chromium.org> Reviewed-by:
-
Sam Sebree authored
This is a very small change which must go in before https://chromium-review.googlesource.com/c/chromium/src/+/1731108 is able to land. Certain WPT tests for synthetic modules were spawning DCHECK crashes by JSObject::SetNormalizedProperty. Export names were previously failing: DCHECK(name->IsUniqueName()); This small change corrects the issue and allows Module::GetModuleNamespace to run correctly. This change aligns synthetic module behavior for export string storage with JS modules, as well as the spec. chromium: 967018 Change-Id: I151e7150290bd72d4e4753c8c5be243eafae915f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1761583Reviewed-by:
-
Jakob Kummerow authored
This change is very mechanical: own<Foo*> → own<Foo> vec<Foo*> → ownvec<Foo> As usual, everything in third_party/ is straight-up copied from upstream. Change-Id: If5fabda99e2b281da6f2e71ce23a2f5b68aaac86 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1760815 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
-
Tamer Tas authored
Mozilla suite acts as the bottleneck for this bot. This CL bumps the shards for the Mozilla suite. TBR=machenbach@chromium.org Bug: v8:9633 Change-Id: Ia73b2688b29a3387cc69fa8f79c008f6bf0114cd No-Try: True Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1760824Reviewed-by:
Tamer Tas <tmrts@chromium.org> Commit-Queue: Tamer Tas <tmrts@chromium.org> Auto-Submit: Tamer Tas <tmrts@chromium.org> Cr-Commit-Position: refs/heads/master@{#63262}
-
Tamer Tas authored
The bot finishes close to our timeout SLO even after the speed-up attempt at crrev.com/c/1760810. Example failure: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20arm%20-%20sim%20-%20debug/17596 R=solanes@chromium.org,rmcilroy@chromium.org,mslekova@chromium.org,bbudge@chromium.org TBR=machenbach@chromium.org Bug: v8:9633 Change-Id: Ia6ea32e7d465466726dcf16e73b7c7f77c385813 No-Try: True Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1760822 Commit-Queue: Tamer Tas <tmrts@chromium.org> Reviewed-by:
-
v8-ci-autoroll-builder authored
Rolling v8/test/wasm-js/data: https://chromium.googlesource.com/external/github.com/WebAssembly/spec/+log/9867945..d22a765 [interpreter] Simplify wast.js build (Andreas Rossberg) https://chromium.googlesource.com/external/github.com/WebAssembly/spec/+/d22a765 TBR=ahaas@chromium.org,clemensh@chromium.org Change-Id: I81302f32c1aeddc1084f39bbdf715d4460ba74c0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1757701Reviewed-by:
v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#63260}
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/9275a0c..b05c392 Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/ae25381..939b6b1 Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/72fbaf4..a44d67c Rolling v8/third_party/googletest/src: https://chromium.googlesource.com/external/github.com/google/googletest/+log/27e17f7..d5e9e0c Rolling v8/third_party/icu: https://chromium.googlesource.com/chromium/deps/icu/+log/9a5af81..2b2ee71 TBR=machenbach@chromium.org,tmrts@chromium.org Change-Id: I2747105714288f8707c0b9ea13652a74e765ab25 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1757700Reviewed-by:
-
Andrew Comminos authored
Adds support to the CPU profiler for scraping the incumbent contexts of V8 stack frames. While it is generally unsafe to access heap objects during a profiling interrupt, the native context is uniquely usable due to being guaranteed an alive root on the stack, as well as its slots being immutable after context creation. Change-Id: I2c3149c1302b74d2f13aa99d1fdd0cf006e0f9d1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1580020 Commit-Queue: Andrew Comminos <acomminos@fb.com> Reviewed-by:
Yang Guo <yangguo@chromium.org> Reviewed-by:
Alexei Filippov <alph@chromium.org> Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
-
- 19 Aug, 2019 3 commits
-
-
Z Nguyen-Huu authored
Bug: v8:8976 Change-Id: I67b7f625b125395869ae8df06c47b58e8964911f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1754753 Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com> Reviewed-by:
-
Tamer Tas authored
The bot finishes close to our timeout SLO. Example failure: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20arm%20-%20sim%20-%20debug/17582 TBR=machenbach@chromium.org CC=solanes@chromium.org,rmcilroy@chromium.org,mslekova@chromium.org Bug: v8:9633 Change-Id: Ib855d06dce21c13119e38bba2455c5b7cc470160 No-Try: True Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1760810 Commit-Queue: Tamer Tas <tmrts@chromium.org> Reviewed-by:
-
Z Nguyen-Huu authored
This is a reland of f54f92dd. Fix IsFastRegExpPermissive to call BranchIfFastRegExp_Permissive. Original change's description: > [builtins] Port RegExpTest to Torque > > Bug: v8:8976 > Change-Id: Ia4dc120a31eb363599b47b22b749a3146a9c7c73 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1746083 > Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com> > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > Reviewed-by: Tobias Tebbi <tebbi@chromium.org> > Cr-Commit-Position: refs/heads/master@{#63211} Bug: v8:8976, chromium:994041 Change-Id: I86c9c66b060f47164515e29f914b95456c233d30 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1756390 Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com> Reviewed-by:
-
