- 09 Jan, 2018 33 commits
-
-
Michal Majewski authored
--stress-marking and --stress-scavenge flags with the value greater than 0 enable additional tracking, allocation observers etc. --fuzzer-analysis switches --stress-* flags into analysis mode, which means that all allocation observers and additional checks are still executed, but GC is not influenced by them. It also provides analysis information needed by the fuzzer on the stdout. Bug: v8:6972 Change-Id: I5ac45adb311441d57d5b951aeec036e689930e9f Reviewed-on: https://chromium-review.googlesource.com/814536Reviewed-by:
Hannes Payer <hpayer@chromium.org> Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Commit-Queue: Michał Majewski <majeski@google.com> Cr-Commit-Position: refs/heads/master@{#50453}
-
Caitlin Potter authored
https://github.com/tc39/ecma262/pull/988 gained concensus during the september 2017 TC39 meetings. This moves the load of the "next" method to the very beginning of the iteration protocol, rather than during each iteration step. This impacts: - yield* - for-of loops - spread arguments - array spreads In the v8 implementation, this also affects async iteration versions of these things (the sole exception being the Async-From-Sync iterator, which requires a few more changes to work with this, likely done in a followup patch). This change introduces a new AST node, ResolvedProperty, which can be used as a callee by Call nodes to produce the same bytecode as Property calls, without observably re-loading the property. This is used in several AST-desugarings involving the iteration protocol. BUG=v8:6861, v8:5699 R=rmcilroy@chromium.org, neis@chromium.org, adamk@chromium.org Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng Change-Id: Ib81106a0182687fc5efea0bc32302ad06376773b Reviewed-on: https://chromium-review.googlesource.com/687997 Commit-Queue: Caitlin Potter <caitp@igalia.com> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
Adam Klein <adamk@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#50452}
-
Sigurd Schneider authored
Bug: v8:7127, v8:7204, v8:7205 Change-Id: I4eb009492222b208ff8875b4b7940174dfb132ff Reviewed-on: https://chromium-review.googlesource.com/847576 Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Reviewed-by:
Michael Stanton <mvstanton@chromium.org> Cr-Commit-Position: refs/heads/master@{#50451}
-
Andreas Haas authored
R=titzer@chromium.org Change-Id: Iefa0c90f572acbf4cdc3fc4c4f046a760fb59df9 Reviewed-on: https://chromium-review.googlesource.com/857197Reviewed-by:
Ben Titzer <titzer@chromium.org> Commit-Queue: Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/master@{#50450}
-
Michael Starzinger authored
This switches the source positions consumed by {WasmFunctionBuilder} to have type {size_t} instead of {int}. All checks for accidental loss due to overflow in static casts can now be moved into one place. R=clemensh@chromium.org Change-Id: Id0b0da5fe799eac794c9d610c4c4c9a72a587b3f Reviewed-on: https://chromium-review.googlesource.com/857196Reviewed-by:Clemens Hammacher <clemensh@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#50449}
-
Ben L. Titzer authored
Combined with existing masking, provides protection against speculative OOB accesses. R=clemensh@chromium.org Bug: chromium:798964 Change-Id: Ib7cdc8bccc6d22b8b45896c63f69cb647deba383 Reviewed-on: https://chromium-review.googlesource.com/856980 Commit-Queue: Ben Titzer <titzer@chromium.org> Reviewed-by:
-
Clemens Hammacher authored
In Liftoff, we want to trace the cache state basically before or after processing each instruction. Instead of duplicating this code everywhere, introduce a new interface method {NextInstruction}, which is called before each instruction. R=titzer@chromium.org Bug: v8:6600 Change-Id: Iea61738d200076690a8440a75a2fd90018efa43b Reviewed-on: https://chromium-review.googlesource.com/852457 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by: -
Clemens Hammacher authored
This is a reland of f22156bf. Original change's description: > [Liftoff] Rename kConstant to kI32Const > > This makes it more clear that we only store i32 values as constants in > the cache state. > > R=ahaas@chromium.org > > Bug: v8:6600 > Change-Id: I3022e963e864c9c533cbb673bd8502481389799b > Reviewed-on: https://chromium-review.googlesource.com/853870 > Reviewed-by: Andreas Haas <ahaas@chromium.org> > Commit-Queue: Clemens Hammacher <clemensh@chromium.org> > Cr-Commit-Position: refs/heads/master@{#50437} Bug: v8:6600 Change-Id: I4c28f379eab525a0c86866c39b2e6b55f7c5ab1a Reviewed-on: https://chromium-review.googlesource.com/857017 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/master@{#50446}
-
Hannes Payer authored
Bug: chromium:800251 Change-Id: I9cf94a1e17ca12970b5660f0320c02151d7b79a3 Reviewed-on: https://chromium-review.googlesource.com/856637Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Hannes Payer <hpayer@chromium.org> Cr-Commit-Position: refs/heads/master@{#50445}
-
Clemens Hammacher authored
We were trying to disassemble the whole body of a function, including safepoints and the constant pool. This lead to DCHECK errors on mips. This CL fixes that, and adds printing of source positions. It also fixes the output of instructions size to only contain the instructions for both on-the-heap and off-the-heap code. R=titzer@chromium.org Bug: chromium:800233 Change-Id: Idb15a779680af7997eb78aea2a329189b684d53e Reviewed-on: https://chromium-review.googlesource.com/856458Reviewed-by:
-
Clemens Hammacher authored
Loop headers contain a stack check in wasm, hence an exception can be thrown at the position of the loop instruction. This means that for asm.js, we need to store a source position for each loop instruction. R=mstarzinger@chromium.org Bug: chromium:799690 Change-Id: I129abef11461992e2f10af8e6afc28ce1cf83341 Reviewed-on: https://chromium-review.googlesource.com/856338Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#50443}
-
Andreas Haas authored
In d8 a script is executed in a RealmScope. However, all micro task which are created by the script are not executed within the RealmScope at the moment. With this CL I move the execution of the micro task into the RealmScope. I thought about creating a new RealmScope for the micro tasks, but (1) It did not fix the crashing repro; (2) It seems wrong that the micro tasks are executed in a different realm than the script; Therefore I just moved the execution of the micro tasks into the RealmScope of the script. Thereby I moved the execution tasks also into the Context::Scope of the script. The problem is that the Context::Scope surrounds the RealmScope, and when I to open the RealmScope before the Context::Scope, not even the execution of the script works anymore. R=yangguo@chromium.org Bug: chromium:797846 Change-Id: If152af282beec8f0b0564dcc9682fee8588e142c Reviewed-on: https://chromium-review.googlesource.com/856497Reviewed-by:Yang Guo <yangguo@chromium.org> Commit-Queue: Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/master@{#50442}
-
Clemens Hammacher authored
This adds support for i32.eqz, i32.clz, and i32.ctz. R=titzer@chromium.org Bug: v8:6600 Change-Id: I0dd7c14cf98b68463edae7de3ced9a9d1f82de44 Reviewed-on: https://chromium-review.googlesource.com/852456 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
-
Georg Neis authored
- Remove unused deoptimization reasons. - Replace most uses of kNoReason with an actual reason (some are new). - Rename kNoReason to kUnknown. Bug: Change-Id: Ia8df54fca0f0f4885ef0c3523ce8f67b557a635d Reviewed-on: https://chromium-review.googlesource.com/839421Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#50440}
-
sreten.kovacevic authored
Fix implementation of SDL instruction in MIPS64 simulator. Use rt register as unsigned for shift operation. TEST: cctest/test-run-wasm-64/RunWasmTurbofan_Store_i64_narrowed Change-Id: I3a900631f8db401cf041e103436d4ec263a6f1c4 Reviewed-on: https://chromium-review.googlesource.com/856577Reviewed-by:
Ivica Bogosavljevic <ivica.bogosavljevic@mips.com> Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com> Cr-Commit-Position: refs/heads/master@{#50439}
-
Clemens Hammacher authored
This reverts commit f22156bf. Reason for revert: Lots of compile errors. Try bots sloppy?? Original change's description: > [Liftoff] Rename kConstant to kI32Const > > This makes it more clear that we only store i32 values as constants in > the cache state. > > R=ahaas@chromium.org > > Bug: v8:6600 > Change-Id: I3022e963e864c9c533cbb673bd8502481389799b > Reviewed-on: https://chromium-review.googlesource.com/853870 > Reviewed-by: Andreas Haas <ahaas@chromium.org> > Commit-Queue: Clemens Hammacher <clemensh@chromium.org> > Cr-Commit-Position: refs/heads/master@{#50437} TBR=ahaas@chromium.org,clemensh@chromium.org Change-Id: I6e224d4aa03ff18d6d55e9f8d4726fac711c7665 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:6600 Reviewed-on: https://chromium-review.googlesource.com/857016Reviewed-by:
-
Clemens Hammacher authored
This makes it more clear that we only store i32 values as constants in the cache state. R=ahaas@chromium.org Bug: v8:6600 Change-Id: I3022e963e864c9c533cbb673bd8502481389799b Reviewed-on: https://chromium-review.googlesource.com/853870Reviewed-by:
-
v8-autoroll authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/1a03e2d..1ce2f5d Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/95f3b4d..e1f9b2c Rolling v8/third_party/icu: https://chromium.googlesource.com/chromium/deps/icu/+log/e3b480d..f3d25bc TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org Change-Id: I59e5ca65d4ba45ecbddaacc68a7b0c970856a02e Reviewed-on: https://chromium-review.googlesource.com/856836Reviewed-by:
v8 autoroll <v8-autoroll@chromium.org> Commit-Queue: v8 autoroll <v8-autoroll@chromium.org> Cr-Commit-Position: refs/heads/master@{#50436}
-
Choongwoo Han authored
The checked node and used node were mismatched. It checked if "var_unique" is a string, but it used "key" which may not be a string. Bug: v8:4911, v8:7161, chromium:800077 Change-Id: Ia2aee8b77ac33500430365a4800bf9cca40a28fc Reviewed-on: https://chromium-review.googlesource.com/855138Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#50435}
-
Ben L. Titzer authored
This CL simply moves the implementation classes for WASM native module serialization into the CC file and simplifies them a bit. R=mstarzinger@chromium.org Bug: Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng Change-Id: Id560d2c35eb12bdd461f5d80cb5211a2f4f51684 Reviewed-on: https://chromium-review.googlesource.com/856677Reviewed-by:
-
Yang Guo authored
In collaboration with Qingyan Li <qingyan.liqy@alibaba-inc.com>. R=jgruber@chromium.org, mlippautz@chromium.org Bug: v8:7249 Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng Change-Id: I87f62103ec5b31de274fa22ad275f1c1bcb3ed86 Reviewed-on: https://chromium-review.googlesource.com/846750 Commit-Queue: Yang Guo <yangguo@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Reviewed-by:
-
jgruber authored
There were two separate bugs here. First, a signed/unsigned mismatch where we took the result of PositiveNumberToUint32 and treated it as a signed int. Second, AdvanceStringIndex did not handle large input values correctly. Both are fixed by using uint64_t consistently. Bug: chromium:799813, v8:7258 Change-Id: If2819f87986d0ca732bc24df290f6dc7614083e8 Reviewed-on: https://chromium-review.googlesource.com/854272 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/master@{#50432}
-
Leszek Swirski authored
Instead of calling Abort, which was failing when trying to read its string argument as a Smi. Change-Id: I008b8620cbb7df2a56fc5c5ea42f4d573b159f76 Reviewed-on: https://chromium-review.googlesource.com/856778Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/master@{#50431}
-
Clemens Hammacher authored
This adds support for if blocks to Liftoff. R=titzer@chromium.org Bug: v8:6600 Change-Id: Iac7f3ec6526e1259b447ab6ec794a8a1c7ae05c3 Reviewed-on: https://chromium-review.googlesource.com/853501 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
-
sreten.kovacevic authored
Add SDL and SDR instructions to disassembler on MIPS64. Bug: Change-Id: I9cfcfe05d34aa483b8f7504267b76a782dd06558 Reviewed-on: https://chromium-review.googlesource.com/856676Reviewed-by:
-
Michal Majewski authored
Temporary workaround to avoid the same variant name for multiple variants of the same test. Bug: v8:6917 Change-Id: I9a25dcaf81d35da0dc2617c089cb4811c2a958cb Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng Reviewed-on: https://chromium-review.googlesource.com/852833 Commit-Queue: Michał Majewski <majeski@google.com> Reviewed-by:
Sergiy Byelozyorov <sergiyb@chromium.org> Reviewed-by:
-
Clemens Hammacher authored
This adds support for direct calls in Liftoff. Drive-by: Fix / extend two tests for calls which were helpful for developing this CL. R=ahaas@chromium.org Bug: v8:6600 Change-Id: I20a98d9dd330da9a020c8c9b5c10b04e94af684d Reviewed-on: https://chromium-review.googlesource.com/847579 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
-
Clemens Hammacher authored
This ensures that there is only one entrance point from C++ to generated code, hence only one method has to be excluded from CFI. It also introduces type safety by only allowing the code to be called with the right arguments. This CL includes minor drive-by fixes in the tests, like removing unused dummy variables. R=mstarzinger@chromium.org Bug: v8:7182 Change-Id: Ied9164a2497db9e7c032324c5e082094fdffc72d Reviewed-on: https://chromium-review.googlesource.com/852213Reviewed-by:
-
Clemens Hammacher authored
Store protected instruction info needed for the wasm trap handler. This code will be used and covered by existing tests once we add support for if-constructs to Liftoff. R=titzer@chromium.org CC=eholk@chromium.org Bug: v8:6600, v8:5277 Change-Id: I508b0ab8572ef8b5c7943564714fcec7e9eb8e3b Reviewed-on: https://chromium-review.googlesource.com/853497 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
Eric Holk <eholk@chromium.org> Cr-Commit-Position: refs/heads/master@{#50425}
-
Hannes Payer authored
Bug: chromium:796896 Change-Id: I7f46f82d079502b8ec04c5e3be5f803ec9e62ffa Reviewed-on: https://chromium-review.googlesource.com/854797 Commit-Queue: Hannes Payer <hpayer@chromium.org> Reviewed-by:
-
Choongwoo Han authored
If there is no constructor or species updates on Array or TypedArrays, then skip lookups of constructor and species so that we can create a new typed array quickly. This path makes TA.p.slice() 4x faster in fast cases. Bug: v8:7161 Change-Id: Ib8d2a3f6b8b5ed356c5822a814164166d1285f64 Reviewed-on: https://chromium-review.googlesource.com/828343 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
-
Clemens Hammacher authored
This seems to be a merge error. The if moved down by a few lines and now actually implements the bounds check instead of bailing out. Taking it out revealed a bug where we were trying to access the lowest 8 bits on a register where this is not allowed on ia32, thus a few more changes were needed in this CL. R=titzer@chromium.org Bug: v8:6600 Change-Id: Ib1ef131a12df050302ae50115493a1fcd8323fe5 Reviewed-on: https://chromium-review.googlesource.com/852734Reviewed-by:
-
Jaroslav Sevcik authored
Bug: chromium:798964 Change-Id: I48d6662d60765f04004b324f67ed3aadf11ee07b Reviewed-on: https://chromium-review.googlesource.com/854132Reviewed-by:
-
- 08 Jan, 2018 7 commits
-
-
Alexey Kozyatinskiy authored
We can call less getters on node objects. R=dgozman@chromium.org Bug: chromium:799791 Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel Change-Id: Iecfe76c2be6b6bed675013ac4aaa117b714d4ba5 Reviewed-on: https://chromium-review.googlesource.com/854623Reviewed-by:
Dmitry Gozman <dgozman@chromium.org> Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org> Cr-Commit-Position: refs/heads/master@{#50420}
-
Junliang Yan authored
Port fba4cdf1 Original Commit Message: This patch breaks out bailout reasons into two enum classes. This helps save 3 bits on the SharedFunctionInfo as we don't have to track the abort reasons. R=gsathya@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com BUG= LOG=N Change-Id: Ib2b2ce10b2f1ef6380193964aa9d868168fe129a Reviewed-on: https://chromium-review.googlesource.com/855016Reviewed-by:
Joran Siu <joransiu@ca.ibm.com> Commit-Queue: Junliang Yan <jyan@ca.ibm.com> Cr-Commit-Position: refs/heads/master@{#50419}
-
Eric Holk authored
This is a reland of 9c79b37a Original change's description: > [wasm] use allocation tracker to track reserved address space > > This is a step towards falling back on bounds checks when there are too many > guarded Wasm memories. > > Bug: v8:7143 > Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng > Change-Id: I01916cbdd5ddb08fe1d946ab83b801f37a8fe1c6 > Reviewed-on: https://chromium-review.googlesource.com/832944 > Commit-Queue: Eric Holk <eholk@chromium.org> > Reviewed-by: Bill Budge <bbudge@chromium.org> > Cr-Commit-Position: refs/heads/master@{#50390} Bug: v8:7143 Change-Id: Iaf0d22d300a3f2da22649552a17162dcf7bc608b Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng Reviewed-on: https://chromium-review.googlesource.com/853142Reviewed-by:
Bill Budge <bbudge@chromium.org> Commit-Queue: Eric Holk <eholk@chromium.org> Cr-Commit-Position: refs/heads/master@{#50418}
-
Sathya Gunasekaran authored
This is just a rebased version of https://chromium-review.googlesource.com/c/v8/v8/+/571453 with no functional changes Bug: v8:6889 Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng Change-Id: Ia082cc09ca527505b288ac88e68e0b74eae94765 Reviewed-on: https://chromium-review.googlesource.com/849423Reviewed-by:
-
Yang Guo authored
This causes issues when running tools/node/fetch_deps.py on systems without gyp as pre-installed python module. And we do not even need to do this for building for node (with GN). R=machenbach@chromium.org Bug: v8:6105 Change-Id: If0089dedf176bb509b9fd000e5fe829f8a32bac6 Reviewed-on: https://chromium-review.googlesource.com/852458Reviewed-by:
-
Clemens Hammacher authored
This fixes two issues with --trace-wasm-decoder and --trace-liftoff. First, cache state tracing in liftoff only makes sense together with --trace-wasm-decoder, so disable it otherwise. Second, we were sometimes hitting a DCHECK with --trace-wasm-decoder on functions which bailed out to Turbofan, since the bailout was resetting the end pointer of the decoder to the current pc. R=titzer@chromium.org Bug: v8:6600 Change-Id: Ib4e052a1cdec6389b12b4a0ea57f07c031324ed5 Reviewed-on: https://chromium-review.googlesource.com/853493 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
-
Choongwoo Han authored
GetProperty CSA implementation bailouts prototype lookup when the holder is a typed array, which is to handle integer indexed exotic cases. However, this strict condition made too much overheads for search of common names such as "constructor". This CL checks the first character of a name, and do not bailout if we are sure that the name cannot be a special index. Bug: v8:4911, v8:7161 Change-Id: I2229ff3bebe14a452718e0b1f8354bb05437c09c Reviewed-on: https://chromium-review.googlesource.com/842963Reviewed-by:
-
