- 29 Jan, 2021 1 commit
-
-
Marja Hölttä authored
Fix 1: Track Scope::needs_home_object and Scope::uses_super_property accurately. When "eval" is seen, figure out whether it can access "super" and if yes, set the corresponding home object as needed. Fix 2: The object literal scope shouldn't be entered for things inside spreads. Original: https://chromium-review.googlesource.com/c/v8/v8/+/2563275 Previous reland: https://chromium-review.googlesource.com/c/v8/v8/+/2637220 This saves memory (the home object doesn't need to be stored for each method, but only once per class) and hopefully makes the home object a constant in the optimized code. Detailed documentation of the changes: https://docs.google.com/document/d/1ZVXcoQdf9IdMsnRI9iyUjyq9NDoEyx9nA3XqMgwflMs/edit?usp=sharing Bug: v8:9237 Bug: chromium:1167918 Bug: chromium:1167981 Bug: chromium:1167988 Bug: chromium:1168055 Bug: chromium:1171195 Bug: chromium:1171600 Change-Id: I9686e0d90cd0c1128757eca440a88748897ee91e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2655509 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/master@{#72422}
-
- 28 Jan, 2021 2 commits
-
-
Benedikt Meurer authored
This adds a [[WebAssemblyMemory]] internal property to ArrayBuffer and SharedArrayBuffer instances that are owned by WebAssembly.Memory objects. This allows the devtools-frontend to find the WebAssembly.Memory for any given ArrayBuffer, making it possible to properly support WebAssembly.memory.grow() eventually, but also showing a reasonable tab title. Before: https://imgur.com/hod9jPR.png After: https://imgur.com/v195VoC.png Bug: chromium:1171621, chromium:1171619, chromium:1166577 Change-Id: Ife22cabdfcf54ab30c234ea4ca86bfbb711ab2f1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2653155 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Kim-Anh Tran <kimanh@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#72403}
-
Marja Hölttä authored
This reverts commit f6450b97. Reason for revert: ClusterFuzz bugs Original change's description: > Reland [super] Store home object in Context instead of JSFunction > > 1) Computed property keys (esp functions in them) shouldn't be inside > the object literal scope. > > 2) I was using an imprecise "maybe uses super" and storing it to > preparse data. This won't fly, since it pollutes sister scopes and > leads to confusion wrt whether an object literal needs a home object > or not. Made it precise (mostly cancelling changes in the original CL). > > 3) PreParser::NewSuperPropertyReference was creating a VariableProxy for > this_function (which made it used) -> inconsistent scopes between > parsing and preparsing. > > 4) MultipleEntryBlockContextScope was messing up the accumulator > > Original: https://chromium-review.googlesource.com/c/v8/v8/+/2563275 > > This saves memory (the home object doesn't need to be stored for each > method, but only once per class) and hopefully makes the home object > a constant in the optimized code. > > Detailed documentation of the changes: > https://docs.google.com/document/d/1ZVXcoQdf9IdMsnRI9iyUjyq9NDoEyx9nA3XqMgwflMs/edit?usp=sharing > > Bug: v8:9237, chromium:1167918, chromium:1167981, chromium:1167988, chromium:1168055 > Change-Id: I4f53f18cc18762c33e53d8c802909b42f1c33538 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2637220 > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Commit-Queue: Marja Hölttä <marja@chromium.org> > Cr-Commit-Position: refs/heads/master@{#72169} TBR=marja@chromium.org,leszeks@chromium.org # Not skipping CQ checks because original CL landed > 1 day ago. Bug: v8:9237 Bug: chromium:1167918 Bug: chromium:1167981 Bug: chromium:1167988 Bug: chromium:1168055 Bug: chromium:1171195 Bug: chromium:1171600 Change-Id: I15209f50c3fc8acf385a23f031ebb64139e2f519 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2653158Reviewed-by: Marja Hölttä <marja@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/master@{#72391}
-
- 27 Jan, 2021 1 commit
-
-
Manos Koukoutos authored
This is a reland of b77deeca Changes compared to original: Add explicit narrowing casts in tests for MSVC. Original change's description: > [wasm-gc] Remove abstract rtts > > In the latest wasm-gc spec, rtts of abstract types are no longer > allowed. Consequently, canonical rtts of concrete types always have > a depth of 0. > > Changes: > - Change the immediate argument of rtts to a type index over a heap > type. Abstract it with TypeIndexImmediate in function body decoding. > This affects: > value_type.h, read_value_type(), decoding of relevant opcodes, > wasm subtyping, WasmInitExpr, consume_init_expr(), and > wasm-module-builder.cc. > - In function-body-decoder-impl.h, update rtt.canon to always produce > an rtt of depth 0. > - Pass a unit32_t type index over a HeapType to all rtt-related > utilities. > - Remove infrastructure for abstract-type rtts from the wasm compilers, > setup-heap-internal.cc, roots.h, and module-instantiate.cc. > - Remove ObjectReferenceKnowledge::rtt_is_i31. Remove related branches > from ref.test, ref.cast and br_on_cast implementations in the wasm > compilers. > - Remove unused 'parent' field from WasmTypeInfo. > - Make the parent argument optional in NewWasmTypeInfo, CreateStructMap, > and CreateArrayMap. > - Use more convenient arguments in IsHeapSubtypeOf. > - Update tests. > > Bug: v8:7748 > Change-Id: Ib45efe0741e6558c9b291fc8b4a75ae303146bdc > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2642248 > Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org> > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> > Cr-Commit-Position: refs/heads/master@{#72321} Bug: v8:7748 Change-Id: I22b204b486fd185077cd6c7f15d492f5143f48fe Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2650207 Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#72355}
-
- 26 Jan, 2021 5 commits
-
-
Benedikt Meurer authored
The contract between V8 and Blink is that embedder fields belong to Blink, at least when the object has two or more of them. Now we had 2-3 embedder fields used by the debug proxies and that was confusing Blink, since it expects the first slot to hold an aligned pointer in that case and we had a HeapObject reference stored there. This is a quickfix, which avoids internal fields completely for the context extension proxy (using interceptors on the prototype instead) and changes the named proxies to store the name table under a private symbol instead of using a second internal field. A proper but way more involved fix is to introduce a proper instance type here and use space in the header instead of misusing embedder fields. Fixed: chromium:1170283 Bug: chromium:1159402 Change-Id: I6c4bbe2fe88fef29a6b9946708588245efbbe72b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2649033 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Auto-Submit: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Yang Guo <yangguo@chromium.org> Cr-Commit-Position: refs/heads/master@{#72323}
-
Clemens Backes authored
This reverts commit b77deeca. Reason for revert: MSVC compile fails: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Win64%20-%20msvc/16535/overview Original change's description: > [wasm-gc] Remove abstract rtts > > In the latest wasm-gc spec, rtts of abstract types are no longer > allowed. Consequently, canonical rtts of concrete types always have > a depth of 0. > > Changes: > - Change the immediate argument of rtts to a type index over a heap > type. Abstract it with TypeIndexImmediate in function body decoding. > This affects: > value_type.h, read_value_type(), decoding of relevant opcodes, > wasm subtyping, WasmInitExpr, consume_init_expr(), and > wasm-module-builder.cc. > - In function-body-decoder-impl.h, update rtt.canon to always produce > an rtt of depth 0. > - Pass a unit32_t type index over a HeapType to all rtt-related > utilities. > - Remove infrastructure for abstract-type rtts from the wasm compilers, > setup-heap-internal.cc, roots.h, and module-instantiate.cc. > - Remove ObjectReferenceKnowledge::rtt_is_i31. Remove related branches > from ref.test, ref.cast and br_on_cast implementations in the wasm > compilers. > - Remove unused 'parent' field from WasmTypeInfo. > - Make the parent argument optional in NewWasmTypeInfo, CreateStructMap, > and CreateArrayMap. > - Use more convenient arguments in IsHeapSubtypeOf. > - Update tests. > > Bug: v8:7748 > Change-Id: Ib45efe0741e6558c9b291fc8b4a75ae303146bdc > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2642248 > Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org> > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> > Cr-Commit-Position: refs/heads/master@{#72321} TBR=ulan@chromium.org,jkummerow@chromium.org,manoskouk@chromium.org Change-Id: I2f0d97f1a34f7c81c5a97d7c37925cb84c66eea3 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:7748 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2650206Reviewed-by: Clemens Backes <clemensb@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#72322}
-
Manos Koukoutos authored
In the latest wasm-gc spec, rtts of abstract types are no longer allowed. Consequently, canonical rtts of concrete types always have a depth of 0. Changes: - Change the immediate argument of rtts to a type index over a heap type. Abstract it with TypeIndexImmediate in function body decoding. This affects: value_type.h, read_value_type(), decoding of relevant opcodes, wasm subtyping, WasmInitExpr, consume_init_expr(), and wasm-module-builder.cc. - In function-body-decoder-impl.h, update rtt.canon to always produce an rtt of depth 0. - Pass a unit32_t type index over a HeapType to all rtt-related utilities. - Remove infrastructure for abstract-type rtts from the wasm compilers, setup-heap-internal.cc, roots.h, and module-instantiate.cc. - Remove ObjectReferenceKnowledge::rtt_is_i31. Remove related branches from ref.test, ref.cast and br_on_cast implementations in the wasm compilers. - Remove unused 'parent' field from WasmTypeInfo. - Make the parent argument optional in NewWasmTypeInfo, CreateStructMap, and CreateArrayMap. - Use more convenient arguments in IsHeapSubtypeOf. - Update tests. Bug: v8:7748 Change-Id: Ib45efe0741e6558c9b291fc8b4a75ae303146bdc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2642248 Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#72321}
-
Georg Neis authored
Change-Id: I702f8c021490f0538a98cad9a61b1dbae60fb881 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2649027Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#72314}
-
Shu-yu Guo authored
This CL implements the upcoming spec change: https://github.com/tc39/proposal-regexp-match-indices/pull/49 A new JSRegExpResultWithIndices subclass is introduced with a separate map and an extra slot for storing the indices. If /d is passed, exec() constructs a JSRegExpResultWithIndices and eagerly builds indices. The existing re-execution logic is removed. Bug: v8:9548 Change-Id: Ic11853e7521017af5e8bd583c7b82bb672821132 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2616873 Commit-Queue: Shu-yu Guo <syg@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#72306}
-
- 22 Jan, 2021 1 commit
-
-
Ulan Degenbaev authored
This ensures that large objects have alignment suitable for a fixed double arrays. Bug: chromium:1161759 Change-Id: I64fe88d641fedbb5e27c2b38c1b9a4e75cab535a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2639959Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#72251}
-
- 20 Jan, 2021 1 commit
-
-
Seth Brenith authored
This change adds Torque field definitions for ScopeInfo and begins to use the Torque-generated accessors in some places. It does not change the in-memory layout of ScopeInfo. Torque compiler changes: - Fix an issue where the parser created constexpr types for classes based on the class name rather than the `generates` clause. This meant that generated accessors referred to the imaginary type HashTable rather than the real C++ type FixedArray. - Don't pass Isolate* through the generated runtime functions that implement Torque macros. Maybe we'll need it eventually, but we don't right now and it complicates a lot of things. - Don't emit `kSomeFieldOffset` if some_field has an unknown offset. Instead, emit a member function `SomeFieldOffset()` which fetches the slice for some_field and returns its offset. - Emit an `AllocatedSize()` member function for classes which have complex length expressions. It fetches the slice for the last field and performs the multiply&add to compute the total object size. - Emit field accessors for fields with complex length expressions, using the new offset functions. - Fix a few minor bugs where Torque can write uncompilable code. With this change, most code still treats ScopeInfo like a FixedArray, so I would like to follow up with some additional changes: 1. Generate a GC visitor for ScopeInfo and use it 2. Generate accessors for struct-typed fields (indexed or otherwise), and use them 3. Get rid of the FixedArray-style get and set accessors; use TaggedField::load and similar instead 4. Inherit from HeapObject rather than FixedArrayBase to remove the unnecessary `length` field After that, there will only be one ugly part left: initialization. I think it's possible to generate a factory function that takes a bunch of iterator parameters and returns a fully-formed, verifiably correct ScopeInfo instance, but doing so is more complicated than the four mostly-mechanical changes listed above. Bug: v8:7793 Change-Id: I55fcfe9189e4d1613c68d49e378da5dc02597b36 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2357758Reviewed-by: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Peter Marshall <petermarshall@chromium.org> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Seth Brenith <seth.brenith@microsoft.com> Cr-Commit-Position: refs/heads/master@{#72187}
-
- 19 Jan, 2021 4 commits
-
-
Z Nguyen-Huu authored
Instead, use Is<NativeContext> then UnsafeCast. Bug: v8:9679 Change-Id: Id87a10fa66ff1c1e0ca0099b1938c72da2437832 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2631554 Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#72175}
-
Marja Hölttä authored
1) Computed property keys (esp functions in them) shouldn't be inside the object literal scope. 2) I was using an imprecise "maybe uses super" and storing it to preparse data. This won't fly, since it pollutes sister scopes and leads to confusion wrt whether an object literal needs a home object or not. Made it precise (mostly cancelling changes in the original CL). 3) PreParser::NewSuperPropertyReference was creating a VariableProxy for this_function (which made it used) -> inconsistent scopes between parsing and preparsing. 4) MultipleEntryBlockContextScope was messing up the accumulator Original: https://chromium-review.googlesource.com/c/v8/v8/+/2563275 This saves memory (the home object doesn't need to be stored for each method, but only once per class) and hopefully makes the home object a constant in the optimized code. Detailed documentation of the changes: https://docs.google.com/document/d/1ZVXcoQdf9IdMsnRI9iyUjyq9NDoEyx9nA3XqMgwflMs/edit?usp=sharing Bug: v8:9237, chromium:1167918, chromium:1167981, chromium:1167988, chromium:1168055 Change-Id: I4f53f18cc18762c33e53d8c802909b42f1c33538 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2637220Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/master@{#72169}
-
Sathya Gunasekaran authored
This will allow us optimize the protector cell checks in the fast path from checking against the function object in every context to just doing a range check against the instance type. This patch adds new instance types for constructor functions that require such protector cell checks. Bug: v8:11256 Change-Id: Iea722f9c6326dfa470149dd02e689a23942097f4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2595442Reviewed-by: Mythri Alle <mythria@chromium.org> Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Camillo Bruni <cbruni@chromium.org> Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org> Cr-Commit-Position: refs/heads/master@{#72146}
-
Maya Lekova authored
This reverts commit 4d5b878b. Reason for revert: Suspected to cause a failure on ChromeOS, which is blocking the roll - https://chromium-review.googlesource.com/c/chromium/src/+/2636263 Original change's description: > [super] Store home object in Context instead of JSFunction > > This saves memory (the home object doesn't need to be stored for each > method, but only once per class) and hopefully makes the home object > a constant in the optimized code. > > Detailed documentation of the changes: > https://docs.google.com/document/d/1ZVXcoQdf9IdMsnRI9iyUjyq9NDoEyx9nA3XqMgwflMs/edit?usp=sharing > > Bug: v8:9237 > Change-Id: Ia0925bdc8bfe54cbefcba6d10f64746d63a530c7 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2563275 > Commit-Queue: Marja Hölttä <marja@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/master@{#72137} TBR=marja@chromium.org,leszeks@chromium.org Change-Id: Idc5a8240cef4da8893ccc608ee4ae0d7206a1ba8 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:9237 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2637215Reviewed-by: Maya Lekova <mslekova@chromium.org> Commit-Queue: Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/master@{#72142}
-
- 18 Jan, 2021 2 commits
-
-
Marja Hölttä authored
This saves memory (the home object doesn't need to be stored for each method, but only once per class) and hopefully makes the home object a constant in the optimized code. Detailed documentation of the changes: https://docs.google.com/document/d/1ZVXcoQdf9IdMsnRI9iyUjyq9NDoEyx9nA3XqMgwflMs/edit?usp=sharing Bug: v8:9237 Change-Id: Ia0925bdc8bfe54cbefcba6d10f64746d63a530c7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2563275 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/master@{#72137}
-
Victor Gomes authored
Removes: - v8_disable_arguments_adaptor GN flag - ArgumentsAdaptorTrampoline - ArgumentsAdaptorFrame class Change-Id: I382ebe6c25c3c172bee5df3e86e762fca10fa392 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2622911Reviewed-by: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Andreas Haas <ahaas@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Commit-Queue: Victor Gomes <victorgomes@chromium.org> Cr-Commit-Position: refs/heads/master@{#72133}
-
- 15 Jan, 2021 1 commit
-
-
Santiago Aboy Solanes authored
This reverts commit b3d09001. Reason for revert: https://chromium-review.googlesource.com/c/v8/v8/+/2565511 has to be reverted, and this was a follow-up to that Original change's description: > [objects] Remove uncached internal external string type > > We shouldn't be creating those anymore since they are not thread-safe. > > Bug: v8:7790 > Change-Id: I4546d995fa32eb076c8dfe9d95301fad719c9e07 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2615347 > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> > Cr-Commit-Position: refs/heads/master@{#72006} TBR=rmcilroy@chromium.org,leszeks@chromium.org,solanes@chromium.org # Not skipping CQ checks because original CL landed > 1 day ago. Bug: v8:7790 Change-Id: I4eb1a6b8446fa602eeb5bf29fbf1fe57182cdbf3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2627605Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Cr-Commit-Position: refs/heads/master@{#72122}
-
- 11 Jan, 2021 1 commit
-
-
Santiago Aboy Solanes authored
We shouldn't be creating those anymore since they are not thread-safe. Bug: v8:7790 Change-Id: I4546d995fa32eb076c8dfe9d95301fad719c9e07 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2615347Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Cr-Commit-Position: refs/heads/master@{#72006}
-
- 08 Jan, 2021 1 commit
-
-
Benedikt Meurer authored
Previously we had introduced a special `v8::internal::WasmValue` type which we used to expose Wasm values to the Scope view in Chromium DevTools. The problem however is that these values cannot be exposed to JavaScript (and in particular not to Debug Evaluate), which means that particularly for v128 and i64 we have inconsistent representations across the various parts of DevTools. This change removes the `wasm` type from the RemoteObject and all the adjacent logic, and paves the way for a uniform representation of Wasm values throughout DevTools. For i64 we will simply use BigInt consistently everywhere, and for i32, f32 and f64 we'll just use Number. For externref we will represent the values as-is directly. For v128 values we currently use a Uint8Array, but will introduce a dedicated WasmSimd128 class in a follow-up CL. Bug: chromium:1071432 Fixed: chromium:1159402 Change-Id: I0671e5736c9c27d7ca376e23ed74f16d36e03c80 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2614428Reviewed-by: Zhi An Ng <zhin@chromium.org> Reviewed-by: Yang Guo <yangguo@chromium.org> Commit-Queue: Zhi An Ng <zhin@chromium.org> Auto-Submit: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#71962}
-
- 17 Dec, 2020 1 commit
-
-
Sathya Gunasekaran authored
This allows the JSFunctionOrBoundFunction instance type range to no longer be stuck at the last of the JSObject instance type range. This will be useful in the future where we extend the function instance types and include them in fast protector cell checks. Bug: v8:11256 Change-Id: I955991576b3cca76b10f76c87748016fe527e3d0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2595275Reviewed-by: Camillo Bruni <cbruni@chromium.org> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org> Cr-Commit-Position: refs/heads/master@{#71826}
-
- 16 Dec, 2020 2 commits
-
-
Sathya Gunasekaran authored
Previously, we were looking up the prototype of the receiver and checking that against %TypedArrayPrototype% before invalidating the protector cell. This is incorrect as it's possible to patch the prototype and then change the constructor property, bypassing this check. This CL adds a new instance type to prototype of all TypedArray constructors and checks the receiver against this instance type. TBR: tebbi@chromium.org Bug: v8:11274, v8:11256 Change-Id: I2ff6280e4cf820b06c5593fe4addd36f7ac656c4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2594776 Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org> Reviewed-by: Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/master@{#71799}
-
Sathya Gunasekaran authored
In the future, these instance types will be used for fast range checks rather than the current slow individual map checks. Bug: v8:11256 Change-Id: I4ad7d5259fbd46c3272a80996a5ac45a400d1f5e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2590040 Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/master@{#71791}
-
- 03 Dec, 2020 1 commit
-
-
Philip Pfaffe authored
Also construct the `JSMap`s used to store these names lazily and only on-demand, and construct them directly instead of first doing a `std::vector<Handle<String>>` and using that to construct the `JSMap`. The latter resulted in a gigantic root set of 150k+ handles, which wasn't well received by the GC. Bug: chromium:1154154 Fixed: chromium:1154564 Also-By: bmeurer@chromium.org Change-Id: I92e8931f15eda133e2a62b5cc53fbe1f2dafcead Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2568275 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Auto-Submit: Philip Pfaffe <pfaffe@chromium.org> Cr-Commit-Position: refs/heads/master@{#71589}
-
- 30 Nov, 2020 1 commit
-
-
Seth Brenith authored
ScopeInfo objects generally start with three fields: flags, parameter count, and local variable count. But a single read-only ScopeInfo instance has none of those fields. This is the empty ScopeInfo, which is used for contexts that don't correspond to any scope (the native context and contexts for builtin functions). Since there is only ever a single instance of the empty ScopeInfo, the memory savings of omitting these fields is trivial, and we can simplify logic somewhat by including them. Rather than checking for length to be zero, this change introduces a new flag indicating that a ScopeInfo instance is the empty one. On its own, this change doesn't provide a whole lot of value. However, it sets us up for two further improvements, which are consistent with the goals outlined in [1]: 1. We should fully describe ScopeInfo fields in Torque. Getting rid of the requirement to check for emptiness would substantially simplify the indexed field expressions. 2. ScopeInfo shouldn't inherit from FixedArray, and shouldn't begin with a `length` field when the length can be computed from the other fields. This would save a small amount of heap memory and avoid any possibility of a mismatch between the two ways of computing the length. [1] https://docs.google.com/document/d/1tiGK7_lubxPHnInI2vscUwMHfadn8gIEa1apmI8HxR4/edit#heading=h.n63k76b3zfwa Bug: v8:8952 Change-Id: I018127698a5d91fb2a91684bc3aec2e27ee27c41 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2561598Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Commit-Queue: Seth Brenith <seth.brenith@microsoft.com> Cr-Commit-Position: refs/heads/master@{#71500}
-
- 24 Nov, 2020 2 commits
-
-
Tobias Tebbi authored
Drive-by Torque changes: - kSize can be non-aligned, use SizeFor() instead for map allocation. - Factory functions use Torque-generated setters directly to work even if they are shadowed. - Allow class generation in the presence of custom weak fields, this was supported already. Bug: v8:7793 Change-Id: I7e2df45d550ff70973e5167459050fd84db03114 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2547285 Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Seth Brenith <seth.brenith@microsoft.com> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Hannes Payer <hpayer@chromium.org> Cr-Commit-Position: refs/heads/master@{#71371}
-
Frank Tang authored
Bug: v8:11174 Change-Id: If84c9056d0147720dabce52154648b4086146d0c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2556258Reviewed-by: Frank Tang <ftang@chromium.org> Reviewed-by: Shu-yu Guo <syg@chromium.org> Commit-Queue: Frank Tang <ftang@chromium.org> Cr-Commit-Position: refs/heads/master@{#71361}
-
- 19 Nov, 2020 2 commits
-
-
Manos Koukoutos authored
Bug: v8:7748 Change-Id: I5d0cc06fafbe7fc05549a4b8fd7f602eaf838bba Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2526382 Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#71283}
-
Gus Caplan authored
Bug: v8:10961 Change-Id: I79f8410cac1c949100231d4c57dbea0379e88475 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2441128 Commit-Queue: Gus Caplan <snek@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/master@{#71279}
-
- 17 Nov, 2020 1 commit
-
-
Tobias Tebbi authored
Drive-by change: Fix wrong reference to FixedRangeBodyDescriptor in implementation-visitor.cc TBR: ulan@chromium.org Change-Id: I8a1f468f35c38f5be1f4e8d1cfcc9f0fd2a16381 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2540546 Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/master@{#71223}
-
- 11 Nov, 2020 1 commit
-
-
Jakob Kummerow authored
Previously, we performed "is A subtype of B?" checks by walking A's supertypes list and comparing every found type to B. This CL stores not just A's immediate parent type on A, but its entire list of supertypes, and uses that list plus compile-time knowledge of B's distance to the root type in order to compare only exactly one of A's supertypes to B. Bug: v8:7748 Change-Id: I0011b72c4b54440b16494918f64d8fb119bef8b0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2527097 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Reviewed-by: Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/master@{#71127}
-
- 10 Nov, 2020 1 commit
-
-
Daniel Clark authored
This change plumbs import assertions from SourceTextModuleDescriptor's ModuleRequestMap into SourceTextModuleInfo via a new ModuleRequest type, where previously there had been only the specifier. SourceTextModuleDescriptor::module_map now deduplicates module requests using the specifier and the import assertions. Continuing to use the specifier alone would cause a loss of information in the event that a module imports from the same specifier multiple times using different sets of assertions. Failing to deduplicate at all would result in multiple requests for statements like `import {a,b,c} from "foo.js"`, which would be a potential performance issue. See design doc at https://docs.google.com/document/d/1yuXgNHSbTAPubT1Mg0JXp5uTrfirkvO1g5cHHCe-LmY for more detail on this decision. v8::internal::ModuleRequest holds the assertions as an array of the form [key1, value1, position1, key2, value2, assertion2, ...]. However the parser still needs to use a map, since duplicate assertion keys need to be detected at parse time. A follow-up change will ensure that assertions are sorted using a proper lexicographic sort. Bug: v8:10958 Change-Id: Iff13fb9a37d58fc1622cd3cce78925ad2b7a14bb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2493060 Commit-Queue: Dan Clark <daniec@microsoft.com> Reviewed-by: Adam Klein <adamk@chromium.org> Reviewed-by: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/master@{#71066}
-
- 09 Nov, 2020 1 commit
-
-
Tobias Tebbi authored
This is a reland of 26f10ecd Change compared to original CL: The deserializer changes StrongDescriptorArray to DescriptorArray. Since this CL uses separate BodyDescriptors for the two kinds of descriptor arrays, this caused a DCHECK failure when the deserializer changes the map while the object is visited from the concurrent marking thread. Fix this by disabling the corresponding checks. Original change's description: > [torque] allow exported classes with custom C++ class > > Introduce a new annotation @customCppClass that can be used for > non-extern @export classes, that is, generate everything, remove > boilerplate from all the internal lists and switches, but allow > a custom C++ class, which in turn also allows overwriting the generated > print and verify functions. > > Port DescriptorArray and StrongDescriptorArray as an example. > > Bug: v8:7793 > Change-Id: I744e52fb4102ac49c0097f1c95bb17d301975bf0 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2489687 > Reviewed-by: Ulan Degenbaev <ulan@chromium.org> > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > Reviewed-by: Seth Brenith <seth.brenith@microsoft.com> > Commit-Queue: Tobias Tebbi <tebbi@chromium.org> > Cr-Commit-Position: refs/heads/master@{#70989} Bug: v8:7793 Change-Id: I7505fb111896991d16d7d113704c8c3676669f34 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2526383Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#71048}
-
- 05 Nov, 2020 2 commits
-
-
Michael Achenbach authored
This reverts commit 26f10ecd. Reason for revert: GC stress failures: https://crbug.com/v8/11114 Original change's description: > [torque] allow exported classes with custom C++ class > > Introduce a new annotation @customCppClass that can be used for > non-extern @export classes, that is, generate everything, remove > boilerplate from all the internal lists and switches, but allow > a custom C++ class, which in turn also allows overwriting the generated > print and verify functions. > > Port DescriptorArray and StrongDescriptorArray as an example. > > Bug: v8:7793 > Change-Id: I744e52fb4102ac49c0097f1c95bb17d301975bf0 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2489687 > Reviewed-by: Ulan Degenbaev <ulan@chromium.org> > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > Reviewed-by: Seth Brenith <seth.brenith@microsoft.com> > Commit-Queue: Tobias Tebbi <tebbi@chromium.org> > Cr-Commit-Position: refs/heads/master@{#70989} TBR=ulan@chromium.org,tebbi@chromium.org,seth.brenith@microsoft.com,nicohartmann@chromium.org Change-Id: I4631db66a76f41cf62b400e8ee64df27e641a320 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:7793,v8:11114 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2521911Reviewed-by: Michael Achenbach <machenbach@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/master@{#70994}
-
Tobias Tebbi authored
Introduce a new annotation @customCppClass that can be used for non-extern @export classes, that is, generate everything, remove boilerplate from all the internal lists and switches, but allow a custom C++ class, which in turn also allows overwriting the generated print and verify functions. Port DescriptorArray and StrongDescriptorArray as an example. Bug: v8:7793 Change-Id: I744e52fb4102ac49c0097f1c95bb17d301975bf0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2489687Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Seth Brenith <seth.brenith@microsoft.com> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#70989}
-
- 02 Nov, 2020 1 commit
-
-
Tobias Tebbi authored
Drive-by fixes: - Use constexpr types to determine C++ type names. - Fix factory constructors to not skip write barriers in old generation. Change-Id: I0ebbfd56c06ad41d02836fb48531ae7eded166bf Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2400994Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#70921}
-
- 30 Oct, 2020 1 commit
-
-
Martin Bidlingmaier authored
This commit adds the 'l' (linear) RegExp flag (as in e.g. /asdf|123/l) that forces execution in linear time. These regexps are handled by the experimental engine. If the experimental engine cannot handle the pattern, an exception is thrown on creation of the regexp. The commit also adds a new global V8 flag and changes an existing one: * --enable-experimental-engine, which turns on recognition of the RegExp 'l' flag. Previously this flag also caused all supported regexps to be executed by the experimental engine; this is not the case anymore. * --default-to-experimental-regexp-engine takes over the previous semantics of --enable-experimental-regexp-engine: We execute all supported regexps with the experimental engine. Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng Bug: v8:10765 Change-Id: I5622a89b19404105e8be280d454e9fdd63c003b3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2461244Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Reviewed-by: Simon Zünd <szuend@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Commit-Queue: Martin Bidlingmaier <mbid@google.com> Cr-Commit-Position: refs/heads/master@{#70892}
-
- 27 Oct, 2020 1 commit
-
-
Mike Stanton authored
This CL provides synchronized get/set to feedback vector slots. The FeedbackNexus is set up to use order preserving reads when used on the background thread, and a lock to ensure coherent read of information for ICKinds with two slots. The main thread takes the lock on sets. This test provides patterns to be followed by concurrent TurboFan. We don't yet access the FeedbackVector on the background thread. This CL only makes it safe to do so. The next step will come when the optimizing compiler begins to query the the vector from the background thread. Currently, with --concurrent-inlining turned on this is done in bytecode serialization on the main thread. Without concurrent inlining, it's also done on the main thread, in both cases using the FeedbackNexus. Bug: v8:7790 Change-Id: I49d8b8031190f91a0da1c24f375b6b6d8a9fe038 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2276210 Commit-Queue: Michael Stanton <mvstanton@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#70797}
-
- 19 Oct, 2020 1 commit
-
-
Frank Emrich authored
This changes OrderedHashMap, OrderedHashSet, and OrderedNameDictionary as follows: - Create a dedicated allocation function AllocateEmpty to create zero- element instances of these classes - Fix bugs resulting from using these zero-element versions Further, this CL - provides a canonical empty versions of OrderedNameDictionary - changes the types of the canonical ordered hash table and hash set from FixedArray to the actual subclasses Bug: v8:7569 Change-Id: I0fe1215e7d164617afa777c8b3208a0857ab6edd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2476315 Commit-Queue: Frank Emrich <emrich@google.com> Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Reviewed-by: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/master@{#70604}
-
- 15 Oct, 2020 1 commit
-
-
Daniel Clark authored
This is the first change in the process of implementing import assertions per https://tc39.es/proposal-import-assertions/. This CR adds support for the empty form of the AssertClause. Also added is a --harmony-import-assertions flag to enable/disable import assertions. For now, the feature is off by default. The next change will enable the parser to handle a non-empty list of AssertEntries. Bug: v8:10958 Change-Id: I0832d89effc27225aa4430605a51690461daf7ad Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2468623Reviewed-by: Marja Hölttä <marja@chromium.org> Commit-Queue: Dan Clark <daniec@microsoft.com> Cr-Commit-Position: refs/heads/master@{#70545}
-