- 06 Mar, 2018 10 commits
-
-
Michael Starzinger authored
Note that {nullptr} is a dangerous sentinel value in V8's object model because it can be interpreted as Smi(0) and hence will turn into a completely different type than the declared return type at runtime. R=ahaas@chromium.org BUG=v8:7509 Change-Id: I89cffa1160a3bf6853f91c04fb90c74ad08888a3 Reviewed-on: https://chromium-review.googlesource.com/948907Reviewed-by:Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
Andreas Haas <ahaas@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#51757}
-
Yang Guo authored
Instead of a hard-coded list of function addresses, we now use a flag on the AccessorInfo object to annotate whether the getter can cause any side effect. Future changes will extend this to InterceptorInfo, CallHandlerInfo, and expose this through the API. R=jgruber@chromium.org, luoe@chromium.org Bug: v8:7515 Change-Id: Id0fedf03493c3bd81913557a5681f8f63660f6a4 Reviewed-on: https://chromium-review.googlesource.com/945909 Commit-Queue: Yang Guo <yangguo@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#51756}
-
Yang Guo authored
R=franzih@chromium.org Change-Id: I5717db794fc797e7c3b0b8f122ddb6dc0702a99e Reviewed-on: https://chromium-review.googlesource.com/941126Reviewed-by:
Franziska Hinkelmann <franzih@chromium.org> Commit-Queue: Yang Guo <yangguo@chromium.org> Cr-Commit-Position: refs/heads/master@{#51755}
-
Ilija Pavlovic authored
For MIPS architecture release 6, following tests will be skipped: cctest/test-run-machops/RunFloat64MulAndFloat64Add1 cctest/test-run-machops/RunFloat64MulAndFloat64Add2 cctest/test-run-machops/RunFloat64MulAndFloat64Sub1 cctest/test-run-machops/RunFloat64MulAndFloat64Sub2 TEST= BUG= Change-Id: Id359580b809d1387d504d98b6d25d6c112cfda78 Reviewed-on: https://chromium-review.googlesource.com/945689Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com> Cr-Commit-Position: refs/heads/master@{#51754}
-
Benedikt Meurer authored
The optimized code for %ArrayIteratorPrototype%.next for holey arrays was wrong, since it would first store the [[NextIndex]] and then check whether it hit a hole. However in that case TurboFan doesn't have any point to deoptimize to, so we need to perform the side-effecting stores only after all checks are done. Bug: v8:7510, v8:7514, chromium:819086 Change-Id: I0214c7124833286113e4dc7403ddc20a82fa8da3 Reviewed-on: https://chromium-review.googlesource.com/950723Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Yang Guo <yangguo@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#51753}
-
Adam Klein authored
Change-Id: I9854c151c9de636ba1d9ac3733c34485831e6cc4 Reviewed-on: https://chromium-review.googlesource.com/946858Reviewed-by:
-
v8-autoroll authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/0fc17e2..06a6e63 Rolling v8/third_party/android_ndk: https://chromium.googlesource.com/android_ndk/+log/e951c37..635bc38 Rolling v8/third_party/android_tools: https://chromium.googlesource.com/android_tools/+log/9a70d48..c22a664 TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org Change-Id: Iadd11a087dd9348b2296d5df8adcd3584a6e6221 Reviewed-on: https://chromium-review.googlesource.com/950563Reviewed-by:
v8 autoroll <v8-autoroll@chromium.org> Commit-Queue: v8 autoroll <v8-autoroll@chromium.org> Cr-Commit-Position: refs/heads/master@{#51751}
-
Junliang Yan authored
R=joransiu@ca.ibm.com Change-Id: I67364f29d494b09786a14b13743f73bef4b64582 Reviewed-on: https://chromium-review.googlesource.com/950242 Commit-Queue: Junliang Yan <jyan@ca.ibm.com> Reviewed-by:
Joran Siu <joransiu@ca.ibm.com> Cr-Commit-Position: refs/heads/master@{#51750}
-
Taketoshi Aono authored
Revert "Revert "[parser] Implements proposal-numeric-separator."" This reverts commit 782f6401. Original CL is https://chromium-review.googlesource.com/c/v8/v8/+/923441 Bug: v8:7317 Change-Id: I6f541c038bad0cff625094ba84aebe582bdeb12f Reviewed-on: https://chromium-review.googlesource.com/945034Reviewed-by:
Sathya Gunasekaran <gsathya@chromium.org> Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org> Cr-Commit-Position: refs/heads/master@{#51749}
-
Junliang Yan authored
xgr kills condition code on the branch R=joransiu@ca.ibm.com Change-Id: I90a75760c96319d8f27512395f904796a114c5e9 Reviewed-on: https://chromium-review.googlesource.com/950135Reviewed-by:
-
- 05 Mar, 2018 30 commits
-
-
Junliang Yan authored
Port 88062a2c Original Commit Message: Implement in-place weak reference handling in GC. Turn FeedbackVector::optimized_code_or_smi into an in-place weak reference (this is the only in-place weak reference at this point). (See bug for design doc.) R=marja@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com BUG=v8:7308 LOG=N Change-Id: I00c6aa7c08524b7769d3428d0c18ce334f35a722 Reviewed-on: https://chromium-review.googlesource.com/949368Reviewed-by:
-
Jakob Kummerow authored
There must not be both an allocating function call and a handle deref in the list of arguments to a call. Depending on the evaluation order that the C++ compiler chooses, the deref could happen before the call and the resulting raw pointer be invalidated by the GC. Bug: chromium:818424 Change-Id: I525947252ff9d0b048a5bf82c2976e0acce739be Reviewed-on: https://chromium-review.googlesource.com/949782Reviewed-by:
Adam Klein <adamk@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#51746}
-
Clemens Hammacher authored
I initially left them out because I thought they are harder to implement than the other float binops, but it turns out it is actually just the same. R=ahaas@chromium.org Bug: v8:6600 Change-Id: I68b98daf4dfaf4e00d57fc68257fe43977c4ae6a Reviewed-on: https://chromium-review.googlesource.com/948543Reviewed-by:
-
Camillo Bruni authored
- Only show ElementsKind for JSObject Maps - Display non-variable instance-size for non-JSObject Maps Change-Id: I224b6ca2985f9c51635cc44ab5faa4cb977695ba Reviewed-on: https://chromium-review.googlesource.com/946489 Commit-Queue: Camillo Bruni <cbruni@chromium.org> Reviewed-by:
-
Camillo Bruni authored
- Provide sorted instance type contribution per GC - Visualize percentages per InstanceType based on the selected GC - Visualize percentags per category - Use some more arrow functions - Introduce helper.js file Bug: v8:7266 Change-Id: I26099cc64d9545b2de9e4574da2faf52d54ad198 No-Try: true Reviewed-on: https://chromium-review.googlesource.com/949222 Commit-Queue: Camillo Bruni <cbruni@chromium.org> Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/master@{#51743}
-
Adam Klein authored
This patch moves the has_braces_ bool to the bit_field_, and moves function_literal_id_ into the freed-up slack space. This saves 4 bytes on 32-bit platforms and 8 bytes on 64-bit. Change-Id: Ib5ba475915e46494c75019cfc184aafe72f6407f Reviewed-on: https://chromium-review.googlesource.com/947467Reviewed-by:
-
Ulan Degenbaev authored
Now the mock platform delays all background tasks and forwards them to the real platform in its destructor. This fixes a race that happens when the background tasks calls TestPlatform::MonotonicallyIncreasingTime() while the mock platform is being destroyed. BUG: v8:7494 Change-Id: I659ccc19121144152f447d59ff3c5e7ef1bec6d5 Reviewed-on: https://chromium-review.googlesource.com/949202Reviewed-by:
-
Clemens Hammacher authored
Minor cleanup: Instead of a cryptic memcpy, just use ReadUnalignedValue and WriteUnalignedValue. Also add DCHECKs to these helpers to ensure that they are only used for trivially copyable types. R=ahaas@chromium.org Bug: v8:7310 Change-Id: Id5014a828573f8d13a6c3a5380eae2f377e8f130 Reviewed-on: https://chromium-review.googlesource.com/948544Reviewed-by:
-
Camillo Bruni authored
IsFixedArray is too broad in many cases and should be replaced by IsFixedArrayExact in the objects stats collection. Bug: v8:7266 Change-Id: I3d5de8b70dc596a391ffdc2a5b4bdeaa5d437712 Reviewed-on: https://chromium-review.googlesource.com/948502Reviewed-by:
-
Ross McIlroy authored
This field is dead since https://chromium-review.googlesource.com/c/v8/v8/+/916261, but got accidentally added back by https://chromium-review.googlesource.com/c/v8/v8/+/919481 due to a bad merge. BUG=v8:5203,chromium:817258 Change-Id: Id6f06de84de7dcd4e6d467edf28974912ad33571 Reviewed-on: https://chromium-review.googlesource.com/948849Reviewed-by:
Mythri Alle <mythria@chromium.org> Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#51738}
-
Michael Starzinger authored
R=ahaas@chromium.org BUG=v8:7509 Change-Id: I928d01e8789ed3d2620f24e439f5a70117b06928 Reviewed-on: https://chromium-review.googlesource.com/947951Reviewed-by:
-
Sigurd Schneider authored
Math fast-path cannot drop arguments because their side-effects must be preserved. For example, Math.imul(x) dropped x entirely, because if x is convertible to an integer, the result is 0. This, however, is not OK because converting x to an integer might throw. Bug: chromium:818070, v8:7250, v8:7240 Change-Id: I8363e6dcd3fc78c879395aacb636d5782c3b023e Reviewed-on: https://chromium-review.googlesource.com/948523Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#51736}
-
Sigurd Schneider authored
Bug: v8:7517, v8:7310 Change-Id: Ic9a1ac8f4a928e1d5d8f807a0875c7314a7777fb Reviewed-on: https://chromium-review.googlesource.com/946095 Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Reviewed-by:
-
Michael Starzinger authored
R=jgruber@chromium.org BUG=v8:7509 Change-Id: If5f7829c4f42e6cb2a8f39d2ddb92a6b024c3506 Reviewed-on: https://chromium-review.googlesource.com/948492Reviewed-by:
-
Georg Neis authored
This is a cosmetic change only. Change-Id: I9a0ea9a23b4fc1490759433153c7d47e492b853d Reviewed-on: https://chromium-review.googlesource.com/936624 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Reviewed-by:
-
Michael Starzinger authored
R=clemensh@chromium.org BUG=v8:7509 Change-Id: Ia423e60f67d3ffa8d8c2250dc9d4cdff89b91076 Reviewed-on: https://chromium-review.googlesource.com/948487 Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by:
-
Marja Hölttä authored
Implement in-place weak reference handling in GC. Turn FeedbackVector::optimized_code_or_smi into an in-place weak reference (this is the only in-place weak reference at this point). (See bug for design doc.) BUG=v8:7308 TBR=yangguo@chromium.org Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng Change-Id: I16d65dc768f10ed431252e23a0df07bee9063534 Reviewed-on: https://chromium-review.googlesource.com/948493 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by:
-
Michael Starzinger authored
This makes sure that the object can be identified by a unique instance type and hence is not accidentally confused with other FixedArrays on the heap. R=clemensh@chromium.org BUG=v8:7509 Change-Id: I20521cdcabbbddecd89ca8cd4bb203a47e1db0cd Reviewed-on: https://chromium-review.googlesource.com/946253Reviewed-by:
-
Vaclav Brozek authored
ArrayIndexOf is a monolithic builtin which does some checking and then handles three groups of fast arrays: those with holey doubles, compacted doubles and SMIs+objects. TF cannot reuse this efficiently, because calling the TFJ ArrayIndexOf duplicates some checks and also does not allow passing arguments through registers. Similarly for ArrayInclude. This CL splits the three different types of fast array handling into a separate TF stubs, and makes the parent TFJ as well as TurboFan itself use them where appropriate. The TODOs not tackled in this CL inculde: * passing an empty context to spare a register when possible * inlining the search loop if there is any performance gain to it (This is the contiunation of http://crrev.com/2757853002, moved due to Rietveld deprecation.) BUG=v8:5985 Change-Id: I00c97b71be4892f8bc7e1ed6d72e02087618a9a6 Reviewed-on: https://chromium-review.googlesource.com/573020 Commit-Queue: Vaclav Brozek <vabr@chromium.org> Reviewed-by:
Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#51729}
-
Sigurd Schneider authored
OpParameter<int32_t> was still used for an operator after the operators parameter changed from int32_t to a struct. Coincidentally, the first field of the struct holds the value previously stored in that int32_t, so correctness tests did not catch this. Bug: chromium:818611, v8:7517 Change-Id: Ie46f084f7fa8117cd3493fc5ceafac11553dc55e Reviewed-on: https://chromium-review.googlesource.com/948546 Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#51728}
-
jgruber authored
Since we currently only fill the constants table if we're serializing, we should only create & finalize the table in that case. Otherwise, leave it initialized to empty_fixed_array. Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng Bug: v8:6666 Change-Id: I6ecbfac9dc9a9dac7ff0f11331be09b1cbfb4c18 Reviewed-on: https://chromium-review.googlesource.com/948490Reviewed-by:
-
Sigurd Schneider authored
Bug: v8:7517, v8:7310 Change-Id: I438bc933d51062bfbb9a419be9c5b67032707fdb Reviewed-on: https://chromium-review.googlesource.com/946090 Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Reviewed-by:
-
Benedikt Meurer authored
This changes the JSArrayIterator to always have only a single instance type, instead of the zoo of instance types that we had before, and which became less useful with the specification update to when "next" is loaded from the iterator now. This greatly simplifies the baseline implementation of the array iterator, which now only looks at the iterated object during %ArrayIteratorPrototype%.next invocations. In TurboFan we introduce a new JSCreateArrayIterator operator, that holds the IterationKind and get's the iterated object as input. When optimizing %ArrayIteratorPrototype%.next in the JSCallReducer, we check whether the receiver is a JSCreateArrayIterator, and if so, we try to infer maps for the iterated object from there. If we find any, we speculatively assume that these won't have changed during iteration (as we did before with the previous approach), and generate fast code for both JSArray and JSTypedArray iteration. Drive-by-fix: Drop the fast_array_iteration protector, it's not necessary anymore since we have the deoptimization guard bit in the JSCallReducer now. This addresses the performance cliff noticed in webpack 4. The minimal repro on the tracking bug goes from console.timeEnd: mono, 124.773000 console.timeEnd: poly, 670.353000 to console.timeEnd: mono, 118.709000 console.timeEnd: poly, 141.393000 so that's a 4.7x improvement. Also make presubmit happy by adding the missing #undef's. Bug: v8:7510, v7:7514 Change-Id: I79a46bfa2cd0f0710e09365ef72519b1bbb667b5 Reviewed-on: https://chromium-review.googlesource.com/946098Reviewed-by:
-
Clemens Hammacher authored
On ia32, support for vsqrtss and vsqrtsd was missing, so I add the implementation of these instructions and disassembly support. On x64, disassembly support for vsqrtss was missing, while vsqrtsd was implemented. Now both are implemented. The implementation of f32.sqrt and f64.sqrt is very straight-forward on ia32 and x64, we can immediately emit the {v}sqrtss or {v}sqrtsd instruction. R=ahaas@chromium.org Bug: v8:6600 Change-Id: Icf3ec05a97a23e94cdf70f4a72f30dd02fbddd13 Reviewed-on: https://chromium-review.googlesource.com/944221Reviewed-by: -
Sigurd Schneider authored
This reverts commit 07c1e641. Reason for revert: Breaks TSAN build. https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/19784 Original change's description: > [in-place weak refs] Add in-place weak references & migrate one WeakCell to it. > > Implement in-place weak reference handling in GC. > > Turn FeedbackVector::optimized_code_or_smi into an in-place weak reference (this > is the only in-place weak reference at this point). > > (See bug for design doc.) > > BUG=v8:7308 > > Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;master.tryserver.chromium.linux:linux_chromium_rel_ng > Change-Id: I0f9f992cb4ee0457c40b7c868317dfb607bfb906 > Reviewed-on: https://chromium-review.googlesource.com/873638 > Commit-Queue: Marja Hölttä <marja@chromium.org> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org> > Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> > Reviewed-by: Yang Guo <yangguo@chromium.org> > Reviewed-by: Hannes Payer <hpayer@chromium.org> > Cr-Commit-Position: refs/heads/master@{#51722} TBR=ulan@chromium.org,marja@chromium.org,yangguo@chromium.org,hpayer@chromium.org,mlippautz@chromium.org,ishell@chromium.org,bmeurer@chromium.org Change-Id: I75a7dd99fbfd2f5922a6c4d2000bea2adfdeac11 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:7308 Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;master.tryserver.chromium.linux:linux_chromium_rel_ng Reviewed-on: https://chromium-review.googlesource.com/948522Reviewed-by:
-
Marja Hölttä authored
Implement in-place weak reference handling in GC. Turn FeedbackVector::optimized_code_or_smi into an in-place weak reference (this is the only in-place weak reference at this point). (See bug for design doc.) BUG=v8:7308 Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;master.tryserver.chromium.linux:linux_chromium_rel_ng Change-Id: I0f9f992cb4ee0457c40b7c868317dfb607bfb906 Reviewed-on: https://chromium-review.googlesource.com/873638 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by:
Hannes Payer <hpayer@chromium.org> Cr-Commit-Position: refs/heads/master@{#51722}
-
Georg Neis authored
Only create spread-related feedback slots when the array literal actually contains a spread. Bug: v8:5940 Change-Id: I0afad81d4bf1a86ebc1bf81f1213f680eb22bc49 Reviewed-on: https://chromium-review.googlesource.com/947955 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/master@{#51721}
-
Sigurd Schneider authored
Bug: v8:7495 Change-Id: Id929804e0d0f78c17d81d07cd6a5c5e571449d35 Reviewed-on: https://chromium-review.googlesource.com/947974Reviewed-by:
Michael Stanton <mvstanton@chromium.org> Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#51720}
-
Georg Neis authored
The CHECK didn't account for the recent introduction of StoreInArrayLiteralIC. Bug: v8:5940, chromium:818438 Change-Id: I73b4120eb39b16d766f0b1a9cb82ba44804b09a3 Reviewed-on: https://chromium-review.googlesource.com/947950Reviewed-by:
-
Sigurd Schneider authored
This also introduces FrameStateInfoOf helper. Bug: v8:7517, v8:7310 Change-Id: If2dd1257fb9384fe957a980077a65154cc014d3b Reviewed-on: https://chromium-review.googlesource.com/946009 Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Reviewed-by:
-
