- 07 Sep, 2017 13 commits
-
-
Andreas Haas authored
The wasm-async fuzzer uses the bytes provided by the fuzzer engine directly as wasm module bytes, compiles them with async compilation, and then tries to execute the "main" function of the module. This "main" can have an infinite loop which causes a timeout in the fuzzer. With this CL the "main" function is first executed with the interpreter. If the execution in the interpreter finishes within 16k steps, which means that there is no infinite loop, also the compiled code is executed. I added the raw fuzzer input as a test case because in this case I really want to test the fuzzer and not V8. R=clemensh@chromium.org Bug: chromium:761784 Change-Id: Id1fe5da0da8670ec821ab9979fdb9454dbde1162 Reviewed-on: https://chromium-review.googlesource.com/651046 Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by:
Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#47874}
-
Michael Starzinger authored
R=rmcilroy@chromium.org BUG=v8:6409 Change-Id: Ib8bb85674f63fed47aa55a775eaade6b14d60f2e Reviewed-on: https://chromium-review.googlesource.com/654040Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#47873}
-
Camillo Bruni authored
Change-Id: If7db250e242350f83b368b33b60399afd5312b36 No-Try: true Reviewed-on: https://chromium-review.googlesource.com/654658Reviewed-by:
Peter Marshall <petermarshall@chromium.org> Commit-Queue: Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/master@{#47872}
-
Camillo Bruni authored
The help output prints the first line of the doc string. Change-Id: I76817d5138b7bb7ba8034c6a5d803b5aaf1201f7 No-Try: true Reviewed-on: https://chromium-review.googlesource.com/654603Reviewed-by:
-
Ross McIlroy authored
JS runtime calls are always created with undefined recievers, so make the bytecode behave similarly to CallUndefinedReciever such that we don't need to push an explicit undefined register for the receiver for such calls. Modifies the Async[Generator/Function]Await[Caught/Uncaught] runtime calls to pass the generator in the first argument rather than the reciever since these runtime calls were desugered in the bytecode generator and explicitly passed the generator in the receiver. Change-Id: I36c8087bb3b663dccd805bfdb1eea04eb6a73269 Reviewed-on: https://chromium-review.googlesource.com/654257Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#47870}
-
Benedikt Meurer authored
Introduce NodeProperties::NoObservableSideEffectBetween to check if there's any observable side effect between two nodes in the effect chain. Use this to guard the insertion of potentially redundant map checks in the lowering of Object.prototype.hasOwnProperty and keyed accesses within a for..in loop. This gives another boost on the for..in performance front. Bug: v8:6702 Change-Id: I68133f14ad388a1a7422714319c9b323d5cf8bc4 Reviewed-on: https://chromium-review.googlesource.com/654640Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Michael Stanton <mvstanton@chromium.org> Cr-Commit-Position: refs/heads/master@{#47869}
-
Franziska Hinkelmann authored
Bug: Change-Id: I3a97b303bcb4cbb4835fb5de8c55a21eaaa93504 Reviewed-on: https://chromium-review.googlesource.com/649615Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Commit-Queue: Franziska Hinkelmann <franzih@chromium.org> Cr-Commit-Position: refs/heads/master@{#47868}
-
jgruber authored
The lazy deserialization builtin id is usually set when the shared function info is created in Factory::NewSharedFunctionInfo, which looks at the given code object to grab the builtin id. However, this doesn't work when the shared function info is created after deserialization, as is the case for harmony features that can be toggled with runtime flags. At this point, lazy builtins have already been replaced by DeserializeLazy in the builtins table. To ensure that the lazy deserialization id is correct in this case, explicitly set it in bootstrapper functions. Bug: v8:6624, v8:6788 Change-Id: Ia6ac3a4842d2659d5de6d92f378ea221b5508040 Reviewed-on: https://chromium-review.googlesource.com/652477 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Yang Guo <yangguo@chromium.org> Cr-Commit-Position: refs/heads/master@{#47867}
-
Mostyn Bramley-Moore authored
Followup after https://chromium-review.googlesource.com/c/v8/v8/+/652427 which triggered FORWARD_DECLARE macro redefinition warnings/errors. Let's make sure to undef this macro at the end of source files that create it. Bug: chromium:746958 Change-Id: Ie70743c836db45eb51f412a0d6359f0f667319d3 Reviewed-on: https://chromium-review.googlesource.com/654657 Commit-Queue: Mostyn Bramley-Moore <mostynb@opera.com> Reviewed-by:
-
jgruber authored
This extends the list by two cases that we currently cannot handle: FunctionPrototypeHasInstance is called directly without going through Call (https://crbug.com/v8/6786). The Proxy constructor uses a custom construct stub (https://crbug.com/v8/6787). Bug: v8:6624,v8:6786,v8:6787 Change-Id: I21b883bf94bfa170d1da7aa812d09f813d881133 Reviewed-on: https://chromium-review.googlesource.com/651424Reviewed-by:
-
Yang Guo authored
This came up in the context of a Twitter discussion, see this particular tweet https://twitter.com/hashseed/status/905684048382754817 and the relevant thread. Change-Id: If2447169df999b64ce701a44321d48ba1bff2a06 Reviewed-on: https://chromium-review.googlesource.com/654598Reviewed-by:
-
Yang Guo authored
This reduces the arm32 binary by around 20kB. R=jkummerow@chromium.org, mstarzinger@chromium.org Bug: v8:6055 Change-Id: If9098e49793b29dceb8292aff6f668ca28a07728 Reviewed-on: https://chromium-review.googlesource.com/652427Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
-
Yuki Shiino authored
As Blink needs a way to define a property without running a script, make Object::DefineOwnProperty use ENTER_V8_NO_SCRIPT if the receiver object is not a JSProxy. Quite similar to https://crrev.com/c/v8/v8/+/608348 Bug: chromium:728583, chromedriver:1978, chromium:762385 Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng Change-Id: If358bf0d156139c456de369ac04da2be6e626143 Reviewed-on: https://chromium-review.googlesource.com/651949 Commit-Queue: Yuki Shiino <yukishiino@chromium.org> Reviewed-by:
Adam Klein <adamk@chromium.org> Reviewed-by:
Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/master@{#47862}
-
- 06 Sep, 2017 22 commits
-
-
Jeremy Roman authored
This reduces the number of times this string is copied from two to one. Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel Change-Id: I8680cfc1ef1d6c2cfd3bc4970fe698bb904ce328 Reviewed-on: https://chromium-review.googlesource.com/652591Reviewed-by:
Aleksey Kozyatinskiy <kozyatinskiy@chromium.org> Commit-Queue: Jeremy Roman <jbroman@chromium.org> Cr-Commit-Position: refs/heads/master@{#47861}
-
Jaideep Bajwa authored
R=joransiu@ca.ibm.com, jyan@ca.ibm.com BUG= LOG=N Change-Id: I353f953b6b2d9c20ebd9d141b33da47761f3e43b Reviewed-on: https://chromium-review.googlesource.com/653808Reviewed-by:
Junliang Yan <jyan@ca.ibm.com> Commit-Queue: Jaideep Bajwa <bjaideep@ca.ibm.com> Cr-Commit-Position: refs/heads/master@{#47860}
-
Mostyn Bramley-Moore authored
This macro is defined all over the place, and often causes macro redefinition errors in jumbo builds. Let's make sure all such instances created in source files are #undef'ed. Candidate files found with: grep -wL '#undef TRACE' $(git grep -wl '#define TRACE' -- '*.cc') While we're at it, let's undef all macros defined in these files. Bug: chromium:746958 Change-Id: I639ca2b141f908457d1b2601cd6d5827dee0ead0 Reviewed-on: https://chromium-review.googlesource.com/652476Reviewed-by:
Mircea Trofin <mtrofin@chromium.org> Reviewed-by:
-
Anisha Rohra authored
Port 30f08f39 Always return to the InterpreterEntryTrampoline rather than calling the InterpreterExitTrampoline from the Return bytecode handler. This fixes a regression which occured if we upset the call/return stack by skipping the return to the InterpreterEntryTrampoline from the return bytecode handler. R=bjaideep@ca.ibm.com, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com BUG= LOG=N Change-Id: Id2bae444e72cd7ddfb74f4861fc2c4f7b5e9bda5 Reviewed-on: https://chromium-review.googlesource.com/653618Reviewed-by:
Jaideep Bajwa <bjaideep@ca.ibm.com> Commit-Queue: Jaideep Bajwa <bjaideep@ca.ibm.com> Cr-Commit-Position: refs/heads/master@{#47858}
-
Sathya Gunasekaran authored
R=adamk@chromium.org Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng Change-Id: Ie59cc231e130fad391508e5c47e01d32d0a78806 Reviewed-on: https://chromium-review.googlesource.com/651357Reviewed-by:
-
Mythri authored
This is the second attempt at removing this. Earlier (https://chromium-review.googlesource.com/579194) there were regressions on some of the functions related to maps and sets. Now that all of them are ported to CSA, we can remove the remaining uses of SetForceInlineFlag. Bug: v8:6682 Change-Id: Iebf296038aa24b65181b0d10531b0569d313e7fc Reviewed-on: https://chromium-review.googlesource.com/647452Reviewed-by:
-
Peter Marshall authored
This reverts commit 9b35364c. Reason for revert: Failing tests on Win64 Debug Original change's description: > [cleanup] Replace more instances of List with std::vector. > > Bug: v8:6333 > Change-Id: Ic1956d3dcfc0309fe2b65344e5af7235d5b804a2 > Reviewed-on: https://chromium-review.googlesource.com/651413 > Reviewed-by: Georg Neis <neis@chromium.org> > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > Commit-Queue: Peter Marshall <petermarshall@chromium.org> > Cr-Commit-Position: refs/heads/master@{#47854} TBR=neis@chromium.org,jgruber@chromium.org,petermarshall@chromium.org Change-Id: Ifa2cd98edd9ec5e1d67c81501f0d9e8aae69536c No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:6333 Reviewed-on: https://chromium-review.googlesource.com/653117Reviewed-by:
-
Peter Marshall authored
Bug: v8:6333 Change-Id: Ic1956d3dcfc0309fe2b65344e5af7235d5b804a2 Reviewed-on: https://chromium-review.googlesource.com/651413Reviewed-by:
Georg Neis <neis@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Commit-Queue: Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#47854}
-
peterwmwong authored
- Convert S.p.{trim, trimLeft, trimRight} to TFJ - Fast paths for one/two byte strings - Added StringTrimAssembler - Added helper kStringTrim runtime to handle slow paths Quick measurements show >2.7x improvement: https://github.com/peterwmwong/v8-perf/tree/master/string-trim Bug: v8:6680 Change-Id: I79929129aa3d5dea20f094d648afe46adbf61a49 Reviewed-on: https://chromium-review.googlesource.com/647647Reviewed-by: -
Michael Starzinger authored
R=clemensh@chromium.org TEST=mjsunit/regress/regress-crbug-762472 BUG=chromium:762472 Change-Id: I8977fb9c9330f03641291b08cf803d0117b7a96a Reviewed-on: https://chromium-review.googlesource.com/652478Reviewed-by:
-
Benedikt Meurer authored
Bug: v8:6702 Change-Id: I6e2fc1a56035b9841ad5c71504b74a89d7259ad1 Reviewed-on: https://chromium-review.googlesource.com/651366Reviewed-by:
-
Mike Stanton authored
JSTests.json had some poor/wrong settings. Bug: Change-Id: Id30589ba2392d2561037fd55d9e77a31ca6c7ad9 Reviewed-on: https://chromium-review.googlesource.com/649534Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Commit-Queue: Michael Stanton <mvstanton@chromium.org> Cr-Commit-Position: refs/heads/master@{#47850}
-
Caitlin Potter authored
The stack value is unused and does not need to be pushed or popped on return from JSEntryTrampoline Bug: Change-Id: I0e1920fc48b63cb0eea66454e5b74d9b3c2d5956 Reviewed-on: https://chromium-review.googlesource.com/650810 Commit-Queue: Caitlin Potter <caitp@igalia.com> Reviewed-by:
-
Yang Guo authored
Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng Change-Id: I1a9561adc44ee1d8a6b68c36604992261c490043 Reviewed-on: https://chromium-review.googlesource.com/651414Reviewed-by:
-
Clemens Hammacher authored
Up to now, each architecture defined all Register types as structs, with lots of redundancy. An often found comment noted that they cannot be classes due to initialization order problems. As these problems are gone with C++11 constexpr constants, I now tried making Registers classes again. All register types now inherit from RegisterBase, which provides a default set of methods and named constructors (like ::from_code, code(), bit(), is_valid(), ...). This design allows to guarantee an interesting property: Each register is either valid, or it's the no_reg register. There are no other invalid registers. This is guaranteed statically by the constexpr constructor, and dynamically by ::from_code. I decided to disallow the default constructor completely, so instead of "Register reg;" you now need "Register reg = no_reg;". This makes explicit how the Register is initialized. I did this change to the x64, ia32, arm, arm64, mips and mips64 ports. Overall, code got much more compact and more safe. In theory, it should also increase performance (since the is_valid() check is simpler), but this is probably not measurable. R=mstarzinger@chromium.org Change-Id: I5ccfa4050daf4e146a557970e9d37fd3d2788d4a Reviewed-on: https://chromium-review.googlesource.com/650927Reviewed-by:
Igor Sheludko <ishell@chromium.org> Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#47847}
-
sreten.kovacevic authored
MIPS[64]: Port: `[Atomics] Make Atomics.exchange a builtin using TF` and `[Atomics] Make Atomics.compareExchange a builtin using TF` Port 301c1237 and 82b5c8c9 Implemented exchange and compareExchange atomics. Bug: Change-Id: I11a0d3d608ecf809c7947dd560884c6451dcdb3c Reviewed-on: https://chromium-review.googlesource.com/649186Reviewed-by:
Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com> Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com> Cr-Commit-Position: refs/heads/master@{#47846}
-
Jaroslav Sevcik authored
Revert "[turbofan] Reland^2 "Polymorphic inlining - try merge map check dispatch with function call dispatch."" This reverts commit 8cf4aafc. Reason for revert: Likely crashes Canary. https://crash.corp.google.com/browse?q=product.name%3D%27Chrome_Mac%27%20AND%20product.version%3D%2763.0.3207.0%27%20AND%20custom_data.ChromeCrashProto.channel%3D%27canary%27%20AND%20custom_data.ChromeCrashProto.ptype%3D%27renderer%27%20AND%20custom_data.ChromeCrashProto.magic_signature_1.name%3D%27v8%3A%3Ainternal%3A%3Acompiler%3A%3AGraphTrimmer%3A%3ATrimGraph%27&sql_dialect=dremelsql&ignore_case=false&enable_rewrite=true&omit_field_name=&omit_field_value=&omit_field_opt=%3D&unnest= Original change's description: > [turbofan] Reland^2 "Polymorphic inlining - try merge map check dispatch with function call dispatch." > > This reverts commit e26e6d88. > > Bug: chromium:758096 > Change-Id: I1d8ecda995c93c84a9a3c24da041fdb730dbd3b2 > Reviewed-on: https://chromium-review.googlesource.com/628169 > Reviewed-by: Tobias Tebbi <tebbi@chromium.org> > Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> > Cr-Commit-Position: refs/heads/master@{#47812} TBR=jarin@chromium.org,tebbi@chromium.org # Not skipping CQ checks because original CL landed > 1 day ago. Bug: chromium:758096 Change-Id: I96b62d08efa25ac1ead30e08401919d42a20ca1b Reviewed-on: https://chromium-review.googlesource.com/652370Reviewed-by:
-
jing.bao authored
Do conditional jump based on the second instruction rather than generate similar assembly code twice. Bug: Change-Id: I8c10f3415f213f88d8222a92671e7104c65befdc Reviewed-on: https://chromium-review.googlesource.com/634631 Commit-Queue: Jing Bao <jing.bao@intel.com> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#47844}
-
Franziska Hinkelmann authored
args.Call() sets a return value on args. Do not reuse the same args object, otherwise the return value might be from the previous Call(). Bug: v8:6627 Change-Id: I05fb2d8036f94908a492d46cc5d746bc145e419e Reviewed-on: https://chromium-review.googlesource.com/651407Reviewed-by:
-
Michael Starzinger authored
R=jarin@chromium.org BUG=v8:6409 Change-Id: Ia0a04ad920b7b5c87e175ba0bcd604ef1e855f0c Reviewed-on: https://chromium-review.googlesource.com/649727Reviewed-by:
-
Mircea Trofin authored
We weren't deleting them correctly - the intention was to delete them when an instance is finalized; the code was deleting them only for the last instance in a chain of instances. Bug: Change-Id: I177a64ac9f10a4993927d9654c032cb3f22eca51 Reviewed-on: https://chromium-review.googlesource.com/651238Reviewed-by:
Brad Nelson <bradnelson@chromium.org> Commit-Queue: Mircea Trofin <mtrofin@chromium.org> Cr-Commit-Position: refs/heads/master@{#47841}
-
Anisha Rohra authored
Port f0acede9 This CL removes the weak-list of JS functions from the context and all the code that iterares over it. This list was being used mainly during deoptimization (for code unlinking) and during garbage collection. Removing it will improve performance of programs that create many closures and trigger many scavenge GC cycles. No extra work is required during garbage collection. However, given that we no longer unlink code from JS functions during deoptimization, we leave it as it is, and on its next activation we check whether the mark_for_deoptimization bit of that code is set, and if it is, than we unlink it and jump to lazy compiled code. This check happens in the prologue of every code object. We needed to change/remove the cctests that used to check something on this list. R=bjaideep@ca.ibm.com, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com BUG= LOG=N Change-Id: I8007a837d43b6a339789cfd727e81ad7f4ac3ae1 Reviewed-on: https://chromium-review.googlesource.com/651891Reviewed-by:
-
- 05 Sep, 2017 5 commits
-
-
Jakob Kummerow authored
Bug: v8:1569 Change-Id: I84317ce1ac145b69caa26452721f71aac88f219e Reviewed-on: https://chromium-review.googlesource.com/636699 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#47839}
-
Franziska Hinkelmann authored
This is a reland of 56772de7 Original change's description: > [api] Add test for EnumeratorCallback and for...in. > > If a QueryCallback is present, it is used to > filter the result from the EnumeratorCallback for > enumerable properties. This tests assures that > for...in loops work correctly with these interceptors. > > Bug: v8:6627 > Change-Id: I1e568beac1e138a330034492b87bd49c22e0c804 > Reviewed-on: https://chromium-review.googlesource.com/609982 > Commit-Queue: Franziska Hinkelmann <franzih@chromium.org> > Reviewed-by: Adam Klein <adamk@chromium.org> > Cr-Commit-Position: refs/heads/master@{#47445} TBR=adamk@chromium.org Bug: v8:6627 Change-Id: I509016a879d175b01f7cc7918758354fe0df8ebf Reviewed-on: https://chromium-review.googlesource.com/650906Reviewed-by:
Franziska Hinkelmann <franzih@chromium.org> Commit-Queue: Franziska Hinkelmann <franzih@chromium.org> Cr-Commit-Position: refs/heads/master@{#47838}
-
Deepti Gandluri authored
BUG=v8:6749 R=titzer@chromium.org Change-Id: I4ac2ac8d8ca98d71dbc5a86c3cca268cd836997c Reviewed-on: https://chromium-review.googlesource.com/645146 Commit-Queue: Deepti Gandluri <gdeepti@chromium.org> Reviewed-by:
Ben Titzer <titzer@chromium.org> Cr-Commit-Position: refs/heads/master@{#47837}
-
Jakob Kummerow authored
Only the error cases of overwriting readonly properties need the language_mode to decide whether to throw or be silent. Reading it from the feedback vector's metadata (just like the C++ code in ic.cc does) removes the need to duplicate each stub for each language_mode ("StoreIC" + "StoreICStrict" etc.). Change-Id: Ic0c67f9d40ca36c65e41b4f162b2ab70d155e549 Reviewed-on: https://chromium-review.googlesource.com/647373Reviewed-by: -
Jakob Kummerow authored
AFAICT this doesn't currently change observable behavior, but should be fixed nonetheless. Change-Id: I1dce90ae5bcad39d7d54dddd2559bd7f7ccbb095 Reviewed-on: https://chromium-review.googlesource.com/648354Reviewed-by:
-
