Skip to content

V
V8
Switch branch/tag
  1. 13 Nov, 2018 2 commits
  3. 12 Nov, 2018 1 commit
  5. 04 Nov, 2018 1 commit
  7. 01 Nov, 2018 1 commit
  9. 31 Oct, 2018 4 commits
  11. 29 Oct, 2018 1 commit
  13. 26 Oct, 2018 1 commit
  15. 24 Oct, 2018 1 commit
  17. 23 Oct, 2018 1 commit
    • Tobias Tebbi's avatar
      [elements] handle OOB-holes in Array.prototype.includes fast-path · 5b92f91c
      Tobias Tebbi authored 
      In the ElementsAccessor fast-path for Array.prototype.includes, we
iterate backing-store elements according to start and length numbers
which might or might not be within the JSArray::length field, for
example when side-effects changed the receiver while start and length
are computed. So even when we have a packed ElementsKind, we might still
observe the hole. This is fine, since logical out-of-bounds accesses
are safe in this case, but it means we must not rely on the
ElementsKind telling us if we can encounter holes.

Bug: chromium:897098
Change-Id: I17db38246aef6edbdd5cee30598cbf7619aba6d8
Reviewed-on: https://chromium-review.googlesource.com/c/1293571Reviewed-by: 's avatarJakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56884}
      5b92f91c
  19. 11 Oct, 2018 1 commit
  21. 08 Oct, 2018 1 commit
  23. 20 Sep, 2018 1 commit
  25. 18 Sep, 2018 2 commits
  27. 04 Sep, 2018 1 commit
    • Mike Stanton's avatar
      [builtins] Enable Torque Array.prototype.splice · fd334b32
      Mike Stanton authored 
      Before, splice was implemented with a C++ fast path and a
comprehensive JavaScript version.

This impl. is entirely in Torque with a fastpath for SMI,
DOUBLE and OBJECT arrays, and a comprehensive slow path.
The same level of "sparse" array support as given by the
array.js implementation is included.

This reland addresses several issues:

* Removed "sparse" array support from splice.
* Addressed ClusterFuzz issue 876443:
  The test and code that uses the fix is in this CL.
  The fix in isolation can be seen here:
  https://chromium-review.googlesource.com/c/v8/v8/+/1199403
* Removed dead code in elements.cc

BUG=chromium:876443, v8:8131, v8:1956, v8:7221

Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I2d4a66c24ba1edabeca34e27e6ff8ee6136ed5f1
Reviewed-on: https://chromium-review.googlesource.com/1201783
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: 's avatarJakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55610}
      fd334b32
  29. 22 Aug, 2018 1 commit
    • Camillo Bruni's avatar
      Reland "[runtime] Improve for-in performance" · 827e6d12
      Camillo Bruni authored 
      This is a reland of 8fa7f9ed

Original change's description:
> [runtime] Improve for-in performance
> 
> - Add fast-path String conversion for Smi (which is the most common case)
>   This improves for-in by ~10% on non-initialized enum-caches
> - Don't use the NumberStringCache for large indices to not overflow the cache
>   during key collection. This improves worst-case performance by ~2.5x
> - Drop number_to_string_native and number_to_string_runtime counters
> 
> Bug: v8:7717
> Change-Id: Ic1ff385e3374e6a7e7e7bdb9ae75fb8c238105d1
> Reviewed-on: https://chromium-review.googlesource.com/1167049
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55233}

Bug: v8:7717
Change-Id: Ie29041b20ca4a06b8e74a4378e7c1118373072ae
Reviewed-on: https://chromium-review.googlesource.com/1183721
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: 's avatarUlan Degenbaev <ulan@chromium.org>
Reviewed-by: 's avatarToon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55316}
      827e6d12
  31. 21 Aug, 2018 1 commit
    • Aseem Garg's avatar
      Revert "[runtime] Improve for-in performance" · a4235f00
      Aseem Garg authored 
      This reverts commit 8fa7f9ed.

Reason for revert: Speculating that this breaks GC stress

Original change's description:
> [runtime] Improve for-in performance
> 
> - Add fast-path String conversion for Smi (which is the most common case)
>   This improves for-in by ~10% on non-initialized enum-caches
> - Don't use the NumberStringCache for large indices to not overflow the cache
>   during key collection. This improves worst-case performance by ~2.5x
> - Drop number_to_string_native and number_to_string_runtime counters
> 
> Bug: v8:7717
> Change-Id: Ic1ff385e3374e6a7e7e7bdb9ae75fb8c238105d1
> Reviewed-on: https://chromium-review.googlesource.com/1167049
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55233}

TBR=ulan@chromium.org,cbruni@chromium.org,verwaest@chromium.org

Change-Id: I8d0332478afcd7c6a3f8fbf1f044b9aa870b6b13
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7717
Reviewed-on: https://chromium-review.googlesource.com/1182676Reviewed-by: 's avatarAseem Garg <aseemgarg@chromium.org>
Commit-Queue: Aseem Garg <aseemgarg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55241}
      a4235f00
  33. 20 Aug, 2018 1 commit
  35. 17 Aug, 2018 1 commit
  37. 13 Aug, 2018 1 commit
  39. 08 Aug, 2018 1 commit
  41. 31 Jul, 2018 2 commits
  43. 25 Jul, 2018 3 commits
  45. 19 Jul, 2018 1 commit
    • Simon Zünd's avatar
      [array] Only use fast-path in Array.p.fill for JSArrays · b87e7623
      Simon Zünd authored 
      This CL changes Array.p.fill to use the baseline implementation
for everything other than JSArray.

One of the reasons is that shadowing the length property on
TypedArrays (and other ElementsKinds) is allowed and should be
respected by Array.p.fill. The fast-path for fill for TypedArrays
expects the indices to be clamped to the actual length of the
underlying backing store and not to some length property.

While this mismatch (and others) could probably be handled properly,
we do the conservative thing and only use the fast-path for specific
JSArrays.

R=jgruber@chromium.org

Bug: chromium:865312
Change-Id: Ib3050e3bfc22d47ca8597b6df34788dc2b59b6e1
Reviewed-on: https://chromium-review.googlesource.com/1142772Reviewed-by: 's avatarJakob Gruber <jgruber@chromium.org>
Commit-Queue: Simon Zünd <szuend@google.com>
Cr-Commit-Position: refs/heads/master@{#54558}
      b87e7623
  47. 18 Jul, 2018 3 commits
  49. 17 Jul, 2018 1 commit
  51. 13 Jul, 2018 2 commits
  53. 12 Jul, 2018 3 commits