- 03 Dec, 2019 4 commits
-
-
Emanuel Ziegler authored
The following changes were introduced with the recent proposal update: - OOB access with 0 length traps - Double drop of segments is allowed - Dropped segments are treated like having size 0 (OOB error) - Active segments are dropped right after initialization R=ahaas@chromium.org Change-Id: I4e9fc4d9212841c7d858585c672143f99287520d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1946355Reviewed-by:
Andreas Haas <ahaas@chromium.org> Commit-Queue: Emanuel Ziegler <ecmziegler@chromium.org> Cr-Commit-Position: refs/heads/master@{#65305}
-
Igor Sheludko authored
Bug: chromium:1029658 Change-Id: I4cb201bbf0a05d2673fcb8a5d19e34a969294c5e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1946335 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#65304}
-
Ng Zhi An authored
Calculate the number of bytes of the stack frame used in PatchPrepareStackFrame using the size of the spill instead of the number of slots. We only need the number of bytes spilled (without adding the number of locals) because whenever we spill, we already track the largest offset, with RecordUsedSpillSlot. GetTotalFrameSlotCount can also be changed to remove the num_locals, in a future patch. Change-Id: I08fe3e81eaebf5f2cf1e11292645663474483447 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1945944 Commit-Queue: Zhi An Ng <zhin@chromium.org> Reviewed-by:
Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#65303}
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/00a14de..a82ba26 Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/0317de9..ca84a42 Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/5ae4817..6d31ed5 Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/ae5343c..d1940b1 TBR=machenbach@chromium.org,tmrts@chromium.org Change-Id: I9bc8f7f48dccef25770eeaa081b36444b79b0913 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1948103Reviewed-by:
v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#65302}
-
- 02 Dec, 2019 31 commits
-
-
Jakob Kummerow authored
CSA::TryLookupElement must check the upper bound for dictionary-mode indices. The "stable map + accessor" branch of FastGetOwnValuesOrEntries must construct its LookupIterator such that it handles the named/indexed distinction correctly. Bug: chromium:1029338,chromium:1029369 Change-Id: I17e74ed24c260c5cfc20c61616e75db7d347f7a5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1943164 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#65301}
-
Georg Neis authored
These hints are different from the rest (they only ever grow) and there's no need to have them in each environment. Bug: v8:7790 Change-Id: I56ed9671f602bcb6faba4003d84fee8b1d6e0128 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1944156 Commit-Queue: Georg Neis <neis@chromium.org> Auto-Submit: Georg Neis <neis@chromium.org> Reviewed-by:
Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/master@{#65300}
-
Jakob Kummerow authored
When converting a Smi to a String, we can skip the check for a cached array index on the result in case of a number-to-string cache hit. When trying to convert a String back to an index, the inlined fast path can check for a cached index (in addition to checking for a cached known negative). Locally this yields about 5% on the JSTests/Proxies/GetIndex* tests. Bug: chromium:1028021 Change-Id: I117eae01b1ad9c5d107ad7e598464b96dae9a6b9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1943160 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
-
Maya Lekova authored
Add serialization of the virtual closures for Function.ptototype.apply and Function.prototype.call. Also add tests for those. Bug: v8:7790 Change-Id: I26374009c09958943ef36eae283a270875234e40 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1943155 Commit-Queue: Maya Lekova <mslekova@chromium.org> Auto-Submit: Maya Lekova <mslekova@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#65298}
-
Maya Lekova authored
This reverts commit c509bb8c. Reason for revert: Breaks arm64 - sim - MSAN, see https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/30050 Original change's description: > [wasm] Share native modules compiled from the same bytes > > Cache native modules in the wasm engine by their wire bytes. This is to > prepare for sharing {Script} objects between multiple {WasmModuleObject} > created from the same bytes. This also saves unnecessary compilation > time and memory. > > R=clemensb@chromium.org > > Bug: v8:6847 > Change-Id: Iad5f70efbfe3f0f134dcb851edbcec50691677e0 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1916603 > Commit-Queue: Thibaud Michaud <thibaudm@chromium.org> > Reviewed-by: Clemens Backes <clemensb@chromium.org> > Cr-Commit-Position: refs/heads/master@{#65296} TBR=clemensb@chromium.org,thibaudm@chromium.org Change-Id: I908b0f59bce26678d0b5d7fddc986384c40b4709 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:6847 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1946334Reviewed-by:
-
Thibaud Michaud authored
Cache native modules in the wasm engine by their wire bytes. This is to prepare for sharing {Script} objects between multiple {WasmModuleObject} created from the same bytes. This also saves unnecessary compilation time and memory. R=clemensb@chromium.org Bug: v8:6847 Change-Id: Iad5f70efbfe3f0f134dcb851edbcec50691677e0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1916603 Commit-Queue: Thibaud Michaud <thibaudm@chromium.org> Reviewed-by: -
Joshua Litt authored
Bug: v8:9838, chromium:1028016 Change-Id: Iae195ac12c8fc01506f04ed5e62fc3c0983c56e0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1944280Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Joshua Litt <joshualitt@chromium.org> Cr-Commit-Position: refs/heads/master@{#65295}
-
Milad Farazmand authored
Change-Id: I01a449f098c7be3f1e071f57542dac6b67fb366d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1944279Reviewed-by:
Junliang Yan <jyan@ca.ibm.com> Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com> Cr-Commit-Position: refs/heads/master@{#65294}
-
Georg Neis authored
... in order to be in sync with JSNativeContextSpecialization. This probably doesn't allow any more optimizations but avoids confusing misses in the broker trace. Bug: v8:7790 Change-Id: Ia99a5828651468af8450028a351692482c21670c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1944155 Commit-Queue: Georg Neis <neis@chromium.org> Commit-Queue: Maya Lekova <mslekova@chromium.org> Auto-Submit: Georg Neis <neis@chromium.org> Reviewed-by:
-
Dan Elphick authored
Removes the following functions: Flush AppendChars WriteAsCFile (only from header since impl was already removed) and moves local function AppendChars into anonymous namespace block. Bug: v8:9810 Change-Id: Icc3ca8458eed4711f25514ac71aa0e6b413ed281 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1921797 Auto-Submit: Dan Elphick <delphick@chromium.org> Reviewed-by:
-
Mike Stanton authored
Loop variable analysis doesn't recognize that the initial type of the loop variable phi combined with the increment type may produce a NaN result through the addition of two infinities of differing sign. This leads to unreachable code and a SIGINT crash. The fix is to consider this case before typing the loop variable phi, falling back to more conservative typing if discovered. R=neis@chromium.org Bug: chromium:1028863 Change-Id: Ic4b5189c4c50c5bbe29e46050de630fd0673de9f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1946352 Commit-Queue: Michael Stanton <mvstanton@chromium.org> Reviewed-by:
-
Mike West authored
Blink CL: https://chromium-review.googlesource.com/c/chromium/src/+/1944474 Bug: chromium:1029700 Change-Id: I91936942b21d133e06f2583a4e3c70951e5e86f4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1946348 Commit-Queue: Mike West <mkwst@chromium.org> Reviewed-by:
-
Dan Elphick authored
Each Pipeline phase now declares kRuntimeCallCounterId which is used to record the runtime stats for the duration of the phase. As a result some manually instantiated counters are removed. All counters have the same name as the phase name with the v8.TF prefix replaced with Optimize. To enforce this, the existing phase_name declaration in each phase has been replaced with a macro that also declares the counter id and its mode. Bug: v8:10006 Change-Id: I836582298b60c30eb794f4c45a8bb16efa17a38e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1943161Reviewed-by:
-
Clemens Backes authored
Code objects are scheduled for logging during compilation. In {CompileToNativeModule}, we then only need to ensure that these objects are actually logged. {LogWasmCodes} would log them independently, which leads to duplicate logging. R=jkummerow@chromium.org Bug: chromium:1029470 Change-Id: I6a187f4d7adcf7ac057f3a266f66244ef7e7102f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1946353Reviewed-by: -
Clemens Backes authored
Instead of logging them as "wasm-unnamed" functions, log them as "wasm-to-js", and append the signature. This moves and generalizes the {AppendSignature} method that was already used to produce the signature string for other wrappers. R=jkummerow@chromium.org Bug: chromium:1029470 Change-Id: Ic911cb19a49dcbc332bf5a4aa195107522ac6945 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1946350 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by: -
Clemens Backes authored
Import wrappers (wasm-to-js) were missing from profiling, since their code is never logged. This CL fixes this by generally logging all wasm code generated, not just actual wasm functions. Also, instead of logging each individual code object (which requires a lock) within another lock, move the code out of the other lock and log all code objects at once. R=jkummerow@chromium.org Bug: chromium:1029470 Change-Id: Ia250d7f3f183b2c1d8e6af4e58dd65ee27df545b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1943163 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by:
-
Clemens Backes authored
This fixes a few thing regarding code logging for profiling: 1) Append the execution tier, otherwise we get two function of the same name. 2) Replace "wasm-function[%d]" by "<wasm-unnamed>", since the index is appended later anyway. 3) Avoid unneeded JS heap and C++ heap allocations during logging. R=jkummerow@chromium.org Bug: chromium:1029470 Change-Id: Ie7af41f21e4595f8d8c574e4ad18273f89f1cb6e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1943162 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by:
-
Ng Zhi An authored
Convert more uses of index into offsets. We record spill in terms of offsets (bytes) rather than slot index, so the name of the method can be changed, and in GetTotalFrameSlotCount we calculate the number of slots used in terms of number of bytes spilled. Bug: v8:9909 Change-Id: I26484c1b040cd4711cc7998cb29d68955bf8ddb6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1934528Reviewed-by:
-
Clemens Backes authored
We already don't do the on-heap round-trip any more. R=jkummerow@chromium.org No-Try: true Change-Id: Ib7223699f6907ca695f17616c280f4aa665e7291 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1946354 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by:
-
Georg Neis authored
Bug: chromium:1028208 Change-Id: I439cb5acf4487ab0e4af0dcd065f1ccb78b2e7a1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1946351Reviewed-by:
Mythri Alle <mythria@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#65282}
-
Jakob Kummerow authored
The flag combination --gc-interval=500 --stress-compaction --stress-flush-bytecode, combined with baking mjsunit.js into the custom snapshot, caused type feedback for "deepEquals" to be forgotten, leading to an unexpected soft deopt. Forcing type feedback collection with %PrepareFunctionForOptimization() fixes that. Change-Id: I954c7ecbe70ca5b803a5fa7cd809c118f7659f21 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1946347Reviewed-by:
Nico Hartmann <nicohartmann@chromium.org> Reviewed-by:
-
Ng Zhi An authored
Bug: v8:9810 Change-Id: I1dd90312b4ae1ad9461a27898f66d7c802dbae76 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1930071 Commit-Queue: Zhi An Ng <zhin@chromium.org> Reviewed-by:
Bill Budge <bbudge@chromium.org> Cr-Commit-Position: refs/heads/master@{#65280}
-
Ng Zhi An authored
Fixed: v8:9980 Bug: v8:9198 Change-Id: Idab55a3d7f7ad45a1491dc7657b8a377e569e050 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1945943Reviewed-by:
Deepti Gandluri <gdeepti@chromium.org> Commit-Queue: Zhi An Ng <zhin@chromium.org> Cr-Commit-Position: refs/heads/master@{#65279}
-
Ulan Degenbaev authored
This removes object visiting logic from IncrementalMarking and makes it call the corresponding methods of MarkCompactCollector. As a result we have one place where objects are visited (on the main thread), which is necessary for implementing per-context visitation. Bug: chromium:973627 Change-Id: Ibdfbb9a910b592307bdba2bd73eada35c80a0d61 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1940154Reviewed-by:
Hannes Payer <hpayer@chromium.org> Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#65278}
-
Ng Zhi An authored
Bug: v8:9886 Change-Id: I321e93d02971c6ba568d9d7c52d464ffc2754665 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1929837 Commit-Queue: Zhi An Ng <zhin@chromium.org> Reviewed-by:
-
Ng Zhi An authored
Adding a regression test for https://crrev.com/c/1930606. This test was generated using --dump-wasm-module, which created a 6KB module, and then running binaryen's wasm-reduce on it until it churned this out, and removing an extra kExprUnreachable. Bug: chromium:1027410 Change-Id: I14ba6ebe52f45e3b3ba943088807e110eebe0339 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1933592Reviewed-by:
-
Ng Zhi An authored
Bug: v8:9886 Change-Id: Idd44fb99be54c56385db55895dba58b35c1b660e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1928150Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Commit-Queue: Zhi An Ng <zhin@chromium.org> Cr-Commit-Position: refs/heads/master@{#65275}
-
Ng Zhi An authored
This change includes splitting the existing SSE_INSTRUCTION_LIST into two: 1. sse instructions with two-operand AVX 2. sse instructions with three-operand AVX Also a drive by fix for disasm of pblendw, the printing of imm8 doesn't not require AND-ing with 3, since all 8 bits are significant. Bug: v8:9561 Change-Id: I56c93a24bb9905ae6422698c793b27f3b9e66d8f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1933593Reviewed-by:
-
Simon Zünd authored
Design doc: bit.ly/v8-repl-mode This CL allows the usage of 'await' without wrapping code in an async function when using REPL mode in global evaluate. REPL mode evaluate is changed to *always* return a Promise. The resolve value of the promise is the completion value of the REPL script. The implementation is based on two existing mechanisms: - Similar to async functions, the content of a REPL script is enclosed in a synthetic 'try' block. Any thrown error is used to reject the Promise of the REPL script. - The content of the synthetic 'try' block is also re-written the same way a normal script is. This is, artificial assignments to a ".result" variable are inserted to simulate a completion value. The difference for REPL scripts is, that ".result" is used to resolve the Promise of the REPL script. - ".result" is not returned directly but wrapped in an object literal: "{ .repl_result: .result}". This is done to prevent resolved promises from being chained and resolved prematurely: > Promse.resolve(42); should evaluate to a promise, not 42. Bug: chromium:1021921 Change-Id: I00a5aafd9126ca7c97d09cd8787a3aec2821a67f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1900464Reviewed-by:Yang Guo <yangguo@chromium.org> Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Reviewed-by:
-
Bartek Nowierski authored
Bug: chromium:1018156 Change-Id: I2133bd8fc4ae4d9ce3c16c50887beb677d979e18 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1924000 Commit-Queue: Bartek Nowierski <bartekn@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#65272}
-
v8-ci-autoroll-builder authored
Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/bcfcc04..0317de9 TBR=machenbach@chromium.org,tmrts@chromium.org Change-Id: I21e8f3bf8a9c0cfdd3c0db2bd49386eede39870e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1944233Reviewed-by:
-
- 01 Dec, 2019 2 commits
-
-
Jakob Kummerow authored
No-Try: true Change-Id: I9c4d6f02451872dacf6e5e172ec32afde5f80281 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1943165 Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/master@{#65270}
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/15fd848..00a14de Rolling v8/third_party/googletest/src: https://chromium.googlesource.com/external/github.com/google/googletest/+log/bf0fe87..5395345 Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/e3d2982..ae5343c TBR=machenbach@chromium.org,tmrts@chromium.org Change-Id: I22c818999d745103e09d7438839e03ca80ab7e08 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1944232Reviewed-by:
-
- 30 Nov, 2019 1 commit
-
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/2fc048c..15fd848 Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/b97d4ce..bcfcc04 Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/7c62ed6..5ae4817 Rolling v8/third_party/googletest/src: https://chromium.googlesource.com/external/github.com/google/googletest/+log/076c461..bf0fe87 Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/05979d8..e3d2982 TBR=machenbach@chromium.org,tmrts@chromium.org Change-Id: I9ff4c73b501e7b99b0ef5e2f491d090333e6a342 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1944231Reviewed-by:
-
- 29 Nov, 2019 2 commits
-
-
Hannes Payer authored
Change-Id: I60fdb6af5382e0ccd6bff16f89aad804c13cd900 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1943147Reviewed-by:
-
Sigurd Schneider authored
This CL introduces a CHECK in v8_compile that compilation succeedes. Previously, a failed compilation would lead to undefined behavior or a crash in CompileRun, because it would call Script::Run on a nullptr. This CL introduced v8_try_compile that returns a MaybeLocal and supports test-cases that want to ensure that a compilation fails. Bug: chromium:1014415 Change-Id: I559190da6049f325e8650e4a29c6e387d8ff7af5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1943154 Auto-Submit: Sigurd Schneider <sigurds@chromium.org> Reviewed-by:
-
