- 21 Aug, 2019 10 commits
-
-
Maya Lekova authored
Bug: v8:7790 Change-Id: I5659dd0fd9cc9eb6c129dbdafbc678d6c62289c9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1763528 Commit-Queue: Maya Lekova <mslekova@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Auto-Submit: Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/master@{#63305}
-
Santiago Aboy Solanes authored
Methods TNodified: * CodeStubAssembler::LoadWeakFixedArrayLength * InterpreterAssembler::LoadAndUntagConstantPoolEntryAtOperandIndex * InterpreterAssembler::LoadWeakFixedArrayLength Bug: v8:6949, v8:9396 Change-Id: I30edf1799c35175799ebcca9d9e5d7a815997358 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1755845 Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#63304}
-
Michael Lippautz authored
The tests were assuming that the destructor leaves behind memory in a defined state when the object was allocated with placement new. Turns out gcc with no component builds optimizes away the resetting of the memory. There's a simpler way to test the functionality by inspecting global handle counts. Bug: v8:9639, chromium:995684 Change-Id: I253d84910414c62ca314507b20d2c819f925ea6e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762512 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#63303}
-
Ana Peško authored
Change-Id: If546b1d2dc7019424383ce047ac4eb0410e954f0 Bug: v8:9566 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762289Reviewed-by:
Peter Marshall <petermarshall@chromium.org> Commit-Queue: Ana Pesko <anapesko@google.com> Cr-Commit-Position: refs/heads/master@{#63302}
-
Joshua Litt authored
When regexp match indices are enabled, we stash required data in the JSRegExpResult object, and then build a JSRegExpResultIndices object lazily when the 'indices' property is accessed. This cl simply checks that fast and slow paths produce the same values for result.indices and result.indices.groups. Change-Id: I6322d8eaef4c6e5a0ed3a5aef8b2ff05ac2b2c7a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1763249Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Commit-Queue: Joshua Litt <joshualitt@chromium.org> Cr-Commit-Position: refs/heads/master@{#63301}
-
Keno Fischer authored
This set of macros was only used for one test, while another versions exists in the header file that's used in the rest of the tests. Clean up the duplication. R=ahaas@chromium.org, titzer@chromium.org Change-Id: I851c47a0748b5c78d9a966dfb59b95a3381e7cf7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1747179 Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Reviewed-by:
Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/master@{#63300}
-
Michael Starzinger authored
This adds type reflection support to the {WebAssembly.Module.exports} as well as {WebAssembly.Module.imports} method. It also refactors existing reflective code to use the internal instead of the public embedder API, which is slightly more efficient anyways. R=ahaas@chromium.org TEST=mjsunit/wasm/type-reflection BUG=v8:7742 Change-Id: Ic51b7b4744f7b3ad056a778aecfc4614ca8d6e75 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762019 Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by: -
Michael Lippautz authored
Some scopes that were subtracted were not part of the outer scopes and thus can result in negative values. Change-Id: I2264b27c4b7a48075fed4e3afaa6b6dd27d8daa4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762299Reviewed-by:
-
Joshua Litt authored
Before this cl, we always added slack to JSRegExpResult's initial_map. However, this is incorrect. Now we only add slack to JSRegExpResult's initial map if we intend to actually append the indices descriptor. Bug: chromium:996099 Change-Id: Iac23e92415a9b60409915ff1de9634326ed109c5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1763064 Commit-Queue: Joshua Litt <joshualitt@chromium.org> Reviewed-by:
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/b05c392..5f675b2 Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/939b6b1..04a66c3 Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/a44d67c..5329779 Rolling v8/third_party/fuchsia-sdk: https://chromium.googlesource.com/chromium/src/third_party/fuchsia-sdk/+log/5fd2915..d677ea6 Rolling v8/third_party/googletest/src: https://chromium.googlesource.com/external/github.com/google/googletest/+log/d5e9e0c..c9ccac7 Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/c5d786f..ebf97a6 TBR=machenbach@chromium.org,tmrts@chromium.org Change-Id: I40a2ec0c70121e44744c25ed9f56b804d6df2cf5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762116Reviewed-by:
v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#63296}
-
- 20 Aug, 2019 30 commits
-
-
Shu-yu Guo authored
private name was not found in the current scope. Outer private names were sometimes coincidentally correctly resolved if the innermost ClassScope does not need to allocate a context and does not have a ScopeInfo. ClassScope: :LookupPrivateName was not walking the scope chain when a Change-Id: I18937e6cdf2ad4ae15825b11762fbec7a1358145 Bug: v8:9635 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1761547Reviewed-by:
Sathya Gunasekaran <gsathya@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/master@{#63295}
-
Leszek Swirski authored
Since the mutability of HeapNumbers is determined by their owning object's descriptor array, we can remove the MutableHeapNumber type entirely, at the cost of a few fewer DCHECKs and a couple of TODOs to use the descriptor array information. This is a necessary step towards a follow-up which allows in-place Double -> Tagged transitions Design doc: https://docs.google.com/document/d/1VeKIskAakxQFnUBNkhBmVswgR7Vk6T1kAyKRLhqerb4/ Bug: v8:9606 Change-Id: I13209f9c86f1f204088f6fd80089e17d956b4a50 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1743972 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#63294}
-
Sathya Gunasekaran authored
Previously, without support for converting strings to numbers we'd switch to megamorphic state and go to the runtime always to do the conversion causing a performance cliff. This patch improves the following js-perf-test scores: Object-Lookup-String-Constant-BytecodeHandler: 4.25% Object-Lookup-Index-String-BytecodeHandler: 5.41% Bug: v8:9449 Change-Id: I63787fa84373fc946f1304b0141e48a52a1b4bcb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1690953Reviewed-by:
Igor Sheludko <ishell@chromium.org> Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org> Cr-Commit-Position: refs/heads/master@{#63293}
-
Ng Zhi An authored
Bug: v8:9528 Change-Id: I7df27c3ee949a4c44fa0f78cfded6d8c34575e6b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1754445Reviewed-by:
-
Maya Lekova authored
ReduceTypedArrayPrototypeToStringTag, ReduceObjectGetPrototype and ReduceObjectGetPrototype are now heap-access free. Bug: v8:7790 Change-Id: If7f7ae4c7712326240aa50e02189fee94a57afa9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762022 Commit-Queue: Maya Lekova <mslekova@chromium.org> Reviewed-by:
-
Dan Elphick authored
5th attempt to reland now that crash with cpu profiler combined with code caching is fixed. Bug: v8:8510 Change-Id: I3489150a5067c41c36a4b468e412f9398a55135d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762293Reviewed-by:
-
Michael Lippautz authored
TracedGlobal is already cleared by V8 during garbage collections. It's the embedders responsibility to clear the reference if it destroys the underlying reference through other means. Allow embedders to specify whether they want TracedGlobal to execute clear on destruction via TracedGlobalTrait. Bug: chromium:995684 Change-Id: Ieb10cf21f95eb97e01eff15d4fbd83538f17cf7c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762007 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
-
Santiago Aboy Solanes authored
Follow-up CL that TNodifies loads from AnyTagged to TaggedPointer in interpreter-generator.cc for: * DescriptorArray::kEnumCacheOffset * EnumCache::kKeysOffset * EnumCache::kIndicesOffset * JSFunction::kSharedFunctionInfoOffset * JSGeneratorObject::kParametersAndRegistersOffset * JSGeneratorObject::kContextOffset * SourceTextModule::kRegularExportsOffset * SourceTextModule::kRegularImportsOffset Bug: v8:6949, v8:9396 Change-Id: I559d2a5ea353fbd9e1f539f30ce981d70d93714f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1752858 Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Reviewed-by:
-
Mathias Bynens authored
This feature shipped in V8 v7.4: https://v8.dev/blog/v8-release-74#faster-calls-with-arguments-mismatch Bug: v8:8895 Change-Id: I55c50aeda6c61d07b37987404ea09266c9f66702 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762026Reviewed-by:
-
Dan Elphick authored
When deserializing from a code snapshot with logging enabled (e.g. when profiling) then this ensures source positions are collected before creating code events that need them. Bug: chromium:994673, v8:9504 Change-Id: Iad7644e983d3004c4889615cf2104dc4ef40da46 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762023Reviewed-by:
-
Seth Brenith authored
Extend the order-independent annotation parsing logic to include the following forms: @foo // bare annotation (already supported) @foo(0x70) // decimal literal @foo(HI) // identifier @foo("hello there") // quoted string This is obviously still pretty far from annotations in other languages, which usually support arbitrary expressions and multiple parameters, but I think it's sufficient to cover a pretty good variety of usages. The existing class-field annotations @if and @ifnot are reimplemented in the new style, meaning they could now appear in any order relative to other annotations on the same field (and can be repeated, though I doubt it would be of much use to anybody). Change-Id: I97b7c0c9a541ca3126b5ae3a2484688b04dda9f4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1754947 Commit-Queue: Seth Brenith <seth.brenith@microsoft.com> Reviewed-by:Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#63285}
-
Joyee Cheung authored
This patch implements the declaration of private accessors. When iterating over the class properties, we track private accessors associated with the same name in a ZoneHashMap. Once we get to all the necessary components for a private name (we know statically whether we should expect only a setter, only a getter, or both), we emit a call to a runtime function `CreatePrivateAccessors` that creates an AccessorPair, and store the components in it. The AccessorPair is then associated with the private name variable and stored in the context for later retrieval when the private accessors are accessed. Design doc: https://docs.google.com/document/d/10W4begYfs7lmldSqBoQBBt_BKamgT8igqxF9u50RGrI/edit Bug: v8:8330 Change-Id: Ie6d3882507d143b1f645d7ae82b21b7358656e89 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1725670 Commit-Queue: Joyee Cheung <joyee@igalia.com> Reviewed-by:
-
Dan Elphick authored
Fixes bytecode mismatch between lazy and non-lazy where "this" was marked as maybe assigned in constructors that called the super constructor. Since this will return the hole in cases where it was not yet initialized by super (and the hole is explicitly handled by JSContextSpecialization::ReduceJSLoadContext), it's safe to treat it as a constant in all cases. In the case of lazy compilation case, "this" is never added to the ScopeInfo so is never seen as mutable. Bug: chromium:994719 Change-Id: I43478fbc626b19eb1533aa9dec61b7f276ae140b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762025 Commit-Queue: Dan Elphick <delphick@chromium.org> Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/master@{#63283}
-
Dominik Inführ authored
Do not pass it as argument to CreateObjectFillerAt and remove the enum. Bug: v8:9454 Change-Id: Iafa37acbfea73d3cabb1732dbec0944db859fac2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762017Reviewed-by:
-
Keno Fischer authored
Before dd6f4d4f, this function was reading a single u8 and verifying that it was 0x00. The referenced commit dropped this check as part of implementing decoding for table.get, but neglected to change the read type to u32v, which is the specified type of this immediate. Fix that. R=ahaas@chromium.org, titzer@chromium.org Change-Id: Ic2ce795023ec57be2c95aa79e62d3ccd1aa9c43c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1747178 Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by:
-
Jakob Kummerow authored
This just adds the upstream tests; our implementation already had support. Change-Id: If8d340ebe79eae65d12164a01883482d521b8451 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762287Reviewed-by:
-
Jakob Gruber authored
The deoptimizer calculates frame layout based on the translation's `height` field, together with additional data (e.g.: are we looking at the topmost frame? what kind of deopt are we in?). The result is the final deoptimized frame size in bytes, together with a bunch of intermediate results such as the variable frame size (= without the fixed-size portion). In order to consider the deoptimized frame size in optimized stack checks, we will need to calculate the frame layout during compilation in addition to what we currently do during deoptimization. This CL moves in that direction by extracting relevant parts of frame layout calculation into classes that can be reused by both compiler and deoptimizer. These helpers will support both precise and conservative modes; the deoptimizer will use the precise mode (since it has full information), while the instruction selector will use the conservative mode. Bug: v8:9534 Change-Id: I93d6c39f10d251733f4625d3cc161b2010652d02 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1760825 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#63279}
-
Georg Neis authored
... at graph building time already, just like we do for other property accesses. Bug: v8:7790 Change-Id: I7ffc8ee4fb1df91fc59271edd7b70c14f531330a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762018Reviewed-by:
Maya Lekova <mslekova@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#63278}
-
Igor Sheludko authored
... to prepare for merging this back to stable channel. Bug: chromium:992914 Change-Id: Icbb257b5c02417d9222e60346575567360376264 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762021Reviewed-by:
-
Michael Starzinger authored
This adds type reflection support to the {WebAssembly.Module.exports} as well as {WebAssembly.Module.imports} method. It also refactors existing reflective code to use the internal instead of the public embedder API, which is slightly more efficient anyways. R=ahaas@chromium.org TEST=mjsunit/wasm/type-reflection BUG=v8:7742 Change-Id: I168741d382373ec47ebe0517ce7803732cbb3b24 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762011 Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by: -
Santiago Aboy Solanes authored
When TNodifying LoadMap, I went did a proper LoadObjectField<Map> and removed UncheckedCast. However, TNodification makes some code objects too big, as in Large code objects. This makes the x64 no embed bot green again. Bug: v8:9637 Change-Id: I5cb36834d7134c459ff2e2f11a852dd8c8ba5d94 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762015 Auto-Submit: Santiago Aboy Solanes <solanes@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Reviewed-by:
-
Santiago Aboy Solanes authored
This is a CL in a string of CLs that aims to TNodify CSA. In particular, there were some loads that were done in AnyTagged instead of TaggedPointer. TNode-ifying them brings improvement in pointer compression since we are able to decompress using the Pointer decompression. Bug: v8:6949, v8:9396 Change-Id: I368d4f85348f3560a7f71bf66ebc7c4dd978a8dd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1752854Reviewed-by:
-
Michael Starzinger authored
This adds type reflection support to the {WebAssembly.Module.exports} as well as {WebAssembly.Module.imports} method. It also refactors existing reflective code to use the internal instead of the public embedder API, which is slightly more efficient anyways. R=ahaas@chromium.org TEST=mjsunit/wasm/type-reflection BUG=v8:7742 Change-Id: I5f20ea57261f6433b8d86f55054216bf96b41382 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1760826 Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by: -
Joshua Litt authored
Implements match indices for regexp, as specified by https://github.com/tc39/proposal-regexp-match-indices, a stage 3 TC39 proposal. This implementation is hidden behind the '--harmony-regexp-match-indices' flag. Regexp match indices extends the JSRegExpResult object with an array of indices of matches, as well as a dictionary of capture names to match indices. Bug: v8:9548 Change-Id: I9866a2d1f5af6a507de710357cb5e74c694e7558 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1734937 Commit-Queue: Joshua Litt <joshualitt@chromium.org> Reviewed-by:
Adam Klein <adamk@chromium.org> Cr-Commit-Position: refs/heads/master@{#63272}
-
Dominik Inführ authored
Immediately remove recorded old-to-new slots when shrinking objects. This operation needs to drain the store buffer, however the store buffer is supposed to be removed anyway. Also do not remove slots when left-trimming since this isn't needed for correctness. Bug: v8:9454 Change-Id: I751baf2dcd03c87aee9cb1ebd168e05bf373a738 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762012Reviewed-by:
-
Maya Lekova authored
Bug: v8:7790 Change-Id: I2b9971b7944837a5a6943e401b8c9d91f25c515e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762016Reviewed-by:
-
Georg Neis authored
This brings the graph builder in sync with the serializer (and exponentiation in sync with the other binary operators). Bug: chromium:995430, v8:7790 Change-Id: I809b6f3756f75392cdc6747f8bcee8cdf0ee0f74 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762013 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
-
Georg Neis authored
... by making the operator have a control output, since we could deopt after my last change. Bug: chromium:995562, v8:7790 Change-Id: Ibc8c44708b4d43c4b2c3dfab2fd8fdf79c7ea671 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762010 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
-
Santiago Aboy Solanes authored
They were timeouting, e.g https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20-%20arm64%20-%20sim%20-%20pointer%20compression/2193 Change-Id: Icf3fcde15510cbdefcd2da8e66530c589f4423f1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762008 Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Commit-Queue: Maya Lekova <mslekova@chromium.org> Auto-Submit: Santiago Aboy Solanes <solanes@chromium.org> Reviewed-by:
-
Leszek Swirski authored
Chromium has checks which don't like static initializers in binaries, which fires on effect_control_linearizer.cc. We can remove these by making kMinusZeroBits (and family) constexpr, but to do this we have to avoid bit_cast. Instead, set the correct bit pattern manually (thankfully IEEE 754 0.0 is just zero bits, and -0.0 is 0.0 with a set sign bit). Change-Id: If1695ff715ad8f821e956757f8f9f7c850895011 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762009 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Reviewed-by:
-
