- 03 Sep, 2019 3 commits
-
-
Maya Lekova authored
This reverts commit d82600ec. Reason for revert: Blocking the roll, see https://ci.chromium.org/p/chromium/builders/try/linux-rel/181725 Original change's description: > [turbofan] Serialize missing objects > > Added a few objects to the standard objects list, as well as specific > builtins when the corresponding runtime calls are detected in the > serializer. Now JSHeapCopyReducer is needed only when concurrent > inlining is disabled. > > Bug: v8:7790 > Change-Id: I91d933611b0352df8ede4fded665f13669591fef > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1781053 > Reviewed-by: Georg Neis <neis@chromium.org> > Commit-Queue: Maya Lekova <mslekova@chromium.org> > Cr-Commit-Position: refs/heads/master@{#63509} TBR=neis@chromium.org,mslekova@chromium.org Change-Id: I5eb8a8371994822debb852fc2a090ba585826d4a No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:7790 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1782157Reviewed-by:
Maya Lekova <mslekova@chromium.org> Commit-Queue: Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/master@{#63514}
-
Simon Zünd authored
"--print-scopes" uses the {function_} variable to print the function name and locals of a function scope. In case of a pre-parsed function, the function variable of the scope lives in a zone which is nuked after pre-parsing, while the scope lives on. This leaves the {function_} variable pointer in the scope in a state where it points to invalid memory, causing "--print-scopes" to crash. This CL fixes the crash by properly resetting the {function_} pointer. TBR=verwaest@chromium.org Change-Id: Id24dbb605bec883317f676265a920fe0ca662301 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1776094Reviewed-by:Simon Zünd <szuend@chromium.org> Commit-Queue: Simon Zünd <szuend@chromium.org> Auto-Submit: Simon Zünd <szuend@chromium.org> Cr-Commit-Position: refs/heads/master@{#63513}
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/5dd1782..4fa36b1 Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/9f64c5c..5198ea1 Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/6783233..2fef805 TBR=machenbach@chromium.org,tmrts@chromium.org Change-Id: I2357d1ea3e6b28825b4b952ad6bc5db852bdfb18 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1780230Reviewed-by:
v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#63512}
-
- 02 Sep, 2019 23 commits
-
-
Michael Lippautz authored
Those object types can carry embedder fields as they are generated from embedder-provided function templates. Bug: v8:9672 Change-Id: Iaea794ba8bea2ffec3559131eecfe1941479759a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1781048Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/master@{#63511}
-
Dominik Inführ authored
Slots are always valid inside an invalidated area when outside the respective object's current size. This allows us to remove the size from the InvalidatedSlots data structure. This change was enabled by https://crrev.com/c/1771793. Bug: v8:9454 Change-Id: I2b5a7234d47227cb6ad8d67de20e9b5a2028ae83 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1773242Reviewed-by:
Sigurd Schneider <sigurds@chromium.org> Reviewed-by:
-
Maya Lekova authored
Added a few objects to the standard objects list, as well as specific builtins when the corresponding runtime calls are detected in the serializer. Now JSHeapCopyReducer is needed only when concurrent inlining is disabled. Bug: v8:7790 Change-Id: I91d933611b0352df8ede4fded665f13669591fef Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1781053Reviewed-by:
Georg Neis <neis@chromium.org> Commit-Queue: Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/master@{#63509}
-
Jakob Gruber authored
.. and use it for generating faster loads of external references. This changes the stack check instruction sequence from mov ecx,0x567651dc // The address of the stack limit. cmp esp,[ecx] to cmp esp,[ebx+0x3c] This addressing mode was likely forgotten when we recently added root register support on ia32. Bug: chromium:998751,v8:9534 Change-Id: I3521519da1e9d373dfcd83831b3e399e0e9c895b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1781056Reviewed-by:
-
Michael Achenbach authored
NOTRY=true Bug: v8:9601 Change-Id: I0406326dab681843ef8accadefa10a9e85593fb1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1781055Reviewed-by:
Clemens Hammacher <clemensh@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/master@{#63507}
-
Maya Lekova authored
Bug: v8:7790 Change-Id: I79b81d66751707756139db50720080a144bdcd38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1781045 Commit-Queue: Maya Lekova <mslekova@chromium.org> Reviewed-by:
-
Yang Guo authored
R=sigurds@chromium.org Bug: chromium:956475 Change-Id: Ie4ccd84e1c239d771fd9238599c687782ddb1356 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1776097Reviewed-by:
-
Leszek Swirski authored
Similar to https://crrev.com/c/1781047, WordEqual already does the right truncation in the instruction selector. Bug: v8:8948 Change-Id: I92e74bafab6a467aeca1570494e9044f9cf18c46 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1781049 Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/master@{#63504}
-
Ana Peško authored
This CL adds initial tests for the tier-up logic. Change-Id: I6e6ff69604b14387e81b08d178f98d2227b4f496 Bug: v8:9566 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1776080 Commit-Queue: Ana Pesko <anapesko@google.com> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#63503}
-
Thibaud Michaud authored
Allow the backward spilling heuristic to look and spill before the start of the current range. This solves a common scenario where control-flow aware allocation cannot apply the heuristic as efficiently as splintering because it creates smaller live ranges. Bug: v8:9088 Change-Id: I7f8af8bb9c82849fbae0c652baa5011fd890690e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1776085 Commit-Queue: Thibaud Michaud <thibaudm@chromium.org> Reviewed-by:
-
Igor Sheludko authored
... which already does good the right job of generating 32-bit comparisons while Word32Equal() seems to break some optimizations in TurboFan and produce a little bit slower code. Bug: v8:8948 Change-Id: I288656479fa32c34a7253c4879cb3566d7470a6a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1781047 Commit-Queue: Igor Sheludko <ishell@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Igor Sheludko <ishell@chromium.org> Reviewed-by:
-
Dan Elphick authored
If a bytecode mismatch occurs, the original and new bytecode are now printed along with the position of the bytecode mismatch. Bug: v8:8510 Change-Id: Ia3b016fb4e0edde46944533a6a768499b20678d2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1774722 Commit-Queue: Dan Elphick <delphick@chromium.org> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#63500}
-
Leszek Swirski authored
This is a reland of 0736599a. This is a reland of 7e1fbe8f. Original change description: > [ic] In-place Double -> Tagged transitions > > With no more MutableHeapNumber, we can make Double -> Tagged transitions > in-place, at the cost of an extra map check when accessing double fields > to make sure they are still doubles. > > Bug: v8:9606 > Change-Id: I74ff39ed6fba62ee223cd37dfe761f7d73020e1c > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1743973 > Reviewed-by: Tobias Tebbi <tebbi@chromium.org> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Commit-Queue: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/master@{#63374} TBR=verwaest@chromium.org, tebbi@chromium.org Bug: v8:9606 Change-Id: I2d1b7416064d743582f4983fb868316b7e8a4cf2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1777661Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/master@{#63499}
-
Georg Neis authored
Print the file name instead of the function name, as the function name can be ambiguous. Bug: v8:7790 Change-Id: I079eb0e5a0012aff1d241618d132ecd2d3d93c8f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1781043Reviewed-by:
-
Georg Neis authored
- Add serialization for CallNoFeedback, which was missing. - Extend serialization for CallJSRuntime. - Serialize for calls to higher-order Array builtins. - Serialize for calls to Function#apply and Function#call. - Serialize for calls to Reflect.apply and Reflect.construct. - Serialize for calls to Promise constructor. - Fix ConvertReceiverMode in serialization for CallProperty. Bug: v8:7790 Change-Id: I4bba6f45f9b7948ed2ba9c70bd423a23ec29ecf7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1763530Reviewed-by:
-
Peter Marshall authored
When creating a new JSRegExp for a literal, we sometimes create a boilerplate and store it in the feedback vector. Then for future creations, we can copy the boilerplate instead of re-creating the regexp from scratch. When we don't have a feedback vector, we currently create a boilerplate, copy it and return the copy, and then throw out the boilerplate, which is unnecessary. We can just return the first JSRegExp we create. Change-Id: I98b4e3a3082654ea989e0e6ba1524ce080b0125c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1776086Reviewed-by:
-
Michael Achenbach authored
The sanity checks never really worked since the file was missing in the output dir. Runs bailed out with "Error loading file". As both configurations bailed out in the same way, the correctness fuzzer treated it as pass. NOTRY=true Bug: chromium:933076 Change-Id: Id3a2f7e8e3fa8c6654e3e08654d2e9e6b7010484 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1778289Reviewed-by:
Tamer Tas <tmrts@chromium.org> Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/master@{#63495}
-
Michael Achenbach authored
This also ignores the line number for type errors. NOTRY=true Bug: chromium:995075 Change-Id: I9d9a91842383eba60db858c2c2e02df7dda1a9e1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1778287Reviewed-by:
-
Georg Neis authored
Now it's easy to find the bytecode corresponding to a given SFI in logging output. Change-Id: I32100d54830c2dae3cef838f09582e8d023b5ecb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1781044 Commit-Queue: Georg Neis <neis@chromium.org> Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Auto-Submit: Georg Neis <neis@chromium.org> Reviewed-by:
-
Maya Lekova authored
Bug: chromium:998802 Change-Id: I243c00b367ffd1c5c54ca6930681b1b1d3317b26 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1773273 Commit-Queue: Maya Lekova <mslekova@chromium.org> Reviewed-by:
-
Mu Tao authored
Port 2e0bc516 Original Commit Message: Similar to CheckNotAtStart, one can now apply an offset to the CheckAtStart operation. Due to a recent change, all callsites of CheckNotAtStart now need to pass an offset, whereas previously the offset was just assumed to be zero. Change-Id: I8201ae7620809be3767ad32feab069074b3cbf86 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1775983 Auto-Submit: Mu Tao <pamilty@gmail.com> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
-
Mu Tao authored
Port 213504b9 Original Commit Message: The code fields in a JSRegExp object now either contain irregexp compiled code or a trampoline to the interpreter. This way the code can be executed without explicitly checking if the regexp shall be interpreted or executed natively. In case of interpreted regexp the generated bytecode is now stored in its own fields instead of the code fields for Latin1 and UC16 respectively. The signatures of the jitted irregexp match and the regexp interpreter have been equalized. Change-Id: I843b11cfdd9ecbb38f03706bcb86a5cfcbf69050 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1778083 Auto-Submit: Mu Tao <pamilty@gmail.com> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/b99a3be..5dd1782 Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/3d3532b..6783233 TBR=machenbach@chromium.org,tmrts@chromium.org Change-Id: I4872aa1ed13a08e257d7f722c8f0348df943b9c2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1779633Reviewed-by:
-
- 01 Sep, 2019 1 commit
-
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/5f1456d..b99a3be Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/354c81a..9f64c5c Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/5aeddeb..355e97e TBR=machenbach@chromium.org,tmrts@chromium.org Change-Id: Ib817bc78402251bc181b2f5429b9cd335836d935 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1779631Reviewed-by:
-
- 31 Aug, 2019 2 commits
-
-
John Budorick authored
This should allow us to add other Windows-10 versions to pool:Chrome without adversely affecting the V8 bots. Bug: chromium:990885 Change-Id: I760eb6b1fc6f9fb91c9bacce692b21cbc044b261 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1778916 Auto-Submit: John Budorick <jbudorick@chromium.org> Reviewed-by:
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/d2d4319..5f1456d Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/8fe3e6a..354c81a Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/ee8d9ce..5aeddeb Rolling v8/third_party/icu: https://chromium.googlesource.com/chromium/deps/icu/+log/952ccb9..53f6b23 TBR=machenbach@chromium.org,tmrts@chromium.org Change-Id: I0d9c69c1253243928b40aeed62769299f09d50ba Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1779628Reviewed-by:
-
- 30 Aug, 2019 11 commits
-
-
Seth Brenith authored
This change provides a quick way to see string contents in postmortem debugging sessions, without digging through a (possibly very large, in the case of ConsString) tree of properties. As well as being convenient for inspecting String objects, this functionality will also be necessary for displaying property names on JSReceiver objects. In order to support custom behaviors for specific classes, this change extends the existing generated debug reader classes with a visitor pattern. Bug: v8:9376 Change-Id: I70eab9ea4e74ca0fab39bf5998d6a602716a4202 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1771939Reviewed-by:
-
Dan Elphick authored
When changing the code coverage or type profiler modes, first ensure there are source positions for all BytecodeArrays as regenerating the source positions after toggling the mode will result in a bytecode mismatch. Bug: v8:9656, v8:8510 Change-Id: Ic6cf3afec1588f11e5ce5fcbea2fd13e4452e15f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1774721 Commit-Queue: Dan Elphick <delphick@chromium.org> Reviewed-by:
-
Darius Mercadier authored
Our current Freelist uses 47 categories. Because FreeListCategory is about 26 bytes or so, this causes a non-neglieable overhead per page. This CL divides by two the number of categories used. Benchmark have shown that this should not increase old heap size. And since less categories will be used, size of mallocated objects will be smaller. Furthermore,in both precise and fast modes, Scavenger time is lower when using 24 Freelists rather than 47. Bug: v8:9329 Change-Id: I81cca63a0ffd0aad5f9e009a176f401f2299493d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1778941 Commit-Queue: Darius Mercadier <dmercadier@google.com> Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
-
Ross McIlroy authored
Extend stress source positions to also ensure source positions for eagerly compiled inner functions when lazily compiling the outer function. BUG=v8:8510 Change-Id: I66d04beb789f13c15ed87cf10f606723c18f5d8f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1774725 Commit-Queue: Dan Elphick <delphick@chromium.org> Auto-Submit: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
Dan Elphick <delphick@chromium.org> Cr-Commit-Position: refs/heads/master@{#63482}
-
Ulan Degenbaev authored
Currently string and preparse data trimming code creates filler object without clearing the slots in the trimmed area. This currently works because the slots are overwritten by filler/free space map. This CL explicitly clears the slots and makes the code more robust. Bug: v8:9454 Change-Id: I20ad8a210eb17932e46be5df4b42389955b5e5eb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1778023Reviewed-by:
Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#63481}
-
Patrick Thier authored
Commit 213504b9 broke tier-up for regular expressions (Tier-up didn't trigger anymore). This CL fixes this issue. Bug: v8:9516,v8:9566 Change-Id: I76971bc4375f9885e58988eca92be217ddd4d924 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1778291 Auto-Submit: Patrick Thier <pthier@google.com> Commit-Queue: Peter Marshall <petermarshall@chromium.org> Reviewed-by:
-
Georg Schmid authored
This CL adds a LocationReference specifically for slices to Torque. This allows us to safely reference arrays in objects and pass around such references. For an array of T-typed elements, referencing yields a Slice<T>. In addition, the traditional element access syntax ('o.array[i]') now internally produces a slice, indexes it at 'i' and dereferences the resulting HeapReference. Bug: v8:7793 Change-Id: I4af58e4d2feac547c55a1f6f9350a6c510383df2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1771782 Commit-Queue: Georg Schmid <gsps@google.com> Reviewed-by: -
Sathya Gunasekaran authored
This reverts commit f6e08f43. This patch doesn't allow thin/cons strings to be inlined as weak refs to them are not supported by the GC. Bug: v8:9616 Change-Id: I0407654bd9d20fe0182de4b8554e21ddbce8b28c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1774720 Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org> Reviewed-by:
-
Leszek Swirski authored
This is a reland of 1fba0441 Chromium expectation tests have been disabled, and will be enabled Original change's description: > [destructuring] Elide coercible check for simple keys > > Simple object destructuring, such as `let {a,b} = o`, is less efficient > than the equivalent assignments `let a = o.a; let b = o.b`. This is > because it does a nil check of `o` before the assignments. However, this > nil check is not strictly necessary for simple (i.e. non-computed) names, > as there will be an equivalent nil check on the first access to o in > `o.a`. For computed names the computation is unfortunately obervable. > > So, we can elide the nil check when the first property (if any) of the > destructuring target is a non-computed name. This messes a bit with our > error messages, so we re-use the CallPrinter to also find destructuring > assignment based errors, and fiddle with the error message there. As > a side-effect, we also get out the object name in the AST, so we can > output a slightly nicer error message. > > Change-Id: Iafa858e27ed771a146cd3ba57903cc73bb46951d > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1773254 > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Commit-Queue: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/master@{#63453} TBR=verwaest@chromium.org Bug: chromium:999473 Change-Id: Ib0b2e4be433c50521ba1722e1c06b672bfefa405 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1777702Reviewed-by:
-
Benedikt Meurer authored
Generating custom previews can invoke user specified JavaScript (via the `window.devtoolsFormatters` custom formatters feature). These custom formatters were previously invoked in the main page context, even for objects coming from other `<iframe>`s. Instead of using the main renderer context, we should instead generate the custom preview in the creation context of the object. Bug: chromium:997925 Change-Id: Ia07915cff6680153b6727e68117ed565e60bc1c2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1776093Reviewed-by:
Yang Guo <yangguo@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#63476}
-
Georg Neis authored
E.g. make the setup of the ObjectRef hash table more explicit. Tbr: jgruber@chromium.org Bug: v8:7790 Change-Id: I58c03848e7da5c418ff2d6ae1e71b644278f406b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1776089 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
-
