1. 26 Nov, 2019 1 commit
  2. 27 May, 2019 3 commits
    • Benedikt Meurer's avatar
      Reland "[typedarray] Move external/data pointer to JSTypedArray." · 70bd7cf0
      Benedikt Meurer authored
      This is a reland of 4b86fea5 with
      copy&paste typo in CodeStubAssembler::AllocateByteArray() fixed
      (bug led to holes in new space, which was crashing reproducibly
      on the ia32 bot).
      
      Original change's description:
      > [typedarray] Move external/data pointer to JSTypedArray.
      >
      > As the next step in supporting huge typed arrays in V8, this moves the
      > external/data pointer from the FixedTypedArrayBase backing store to the
      > JSTypedArray instance itself, and replaces the special backing stores
      > with a plain ByteArray (removing all the code for the FixedTypedArrayBase
      > class hierarchy). By doing so, we can drastically simplify the system
      > around typed arrays.
      >
      > Note: Several places in the code base used to check the instance type
      > of the elements backing store of a JSTypedArray instead of checking the
      > elements kind on the JSTypedArray map directly. Those had to be fixed,
      > since the backing store is now always a ByteArray.
      >
      > Drive-by-fix: Move all the typed elements access related code into the
      > elements.cc file to properly encapsulate the accesses.
      >
      > Doc: http://doc/1Z-wM2qwvAuxH46e9ivtkYvKzzwYZg8ymm0x0wJaomow
      > Bug: chromium:951196, chromium:965583, v8:4153, v8:7881, v8:9183
      > Change-Id: I8cc06b190c53e34155000b4560f5f3ef40621646
      > Cq-Include-Trybots: luci.chromium.try:linux-rel,win7-rel
      > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627535
      > Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
      > Reviewed-by: Peter Marshall <petermarshall@chromium.org>
      > Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
      > Reviewed-by: Simon Zünd <szuend@chromium.org>
      > Cr-Commit-Position: refs/heads/master@{#61855}
      
      Tbr: petermarshall@chromium.org
      Bug: chromium:951196, chromium:965583, v8:4153, v8:7881, v8:9183
      Change-Id: I87fcdb28532c5f08cc227332a4d59546cb423810
      Cq-Include-Trybots: luci.chromium.try:linux-rel, win7-rel
      Cq-Include-Trybots: luci.v8.try:v8_linux_shared_compile_rel
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1631592Reviewed-by: 's avatarBenedikt Meurer <bmeurer@chromium.org>
      Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#61864}
      70bd7cf0
    • Clemens Hammacher's avatar
      Revert "[typedarray] Move external/data pointer to JSTypedArray." · e4db146a
      Clemens Hammacher authored
      This reverts commit 4b86fea5.
      
      Reason for revert: Fails on linux shared: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20shared/31045
      
      Original change's description:
      > [typedarray] Move external/data pointer to JSTypedArray.
      > 
      > As the next step in supporting huge typed arrays in V8, this moves the
      > external/data pointer from the FixedTypedArrayBase backing store to the
      > JSTypedArray instance itself, and replaces the special backing stores
      > with a plain ByteArray (removing all the code for the FixedTypedArrayBase
      > class hierarchy). By doing so, we can drastically simplify the system
      > around typed arrays.
      > 
      > Note: Several places in the code base used to check the instance type
      > of the elements backing store of a JSTypedArray instead of checking the
      > elements kind on the JSTypedArray map directly. Those had to be fixed,
      > since the backing store is now always a ByteArray.
      > 
      > Drive-by-fix: Move all the typed elements access related code into the
      > elements.cc file to properly encapsulate the accesses.
      > 
      > Doc: http://doc/1Z-wM2qwvAuxH46e9ivtkYvKzzwYZg8ymm0x0wJaomow
      > Bug: chromium:951196, chromium:965583, v8:4153, v8:7881, v8:9183
      > Change-Id: I8cc06b190c53e34155000b4560f5f3ef40621646
      > Cq-Include-Trybots: luci.chromium.try:linux-rel,win7-rel
      > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627535
      > Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
      > Reviewed-by: Peter Marshall <petermarshall@chromium.org>
      > Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
      > Reviewed-by: Simon Zünd <szuend@chromium.org>
      > Cr-Commit-Position: refs/heads/master@{#61855}
      
      TBR=ulan@chromium.org,yangguo@chromium.org,titzer@chromium.org,sigurds@chromium.org,petermarshall@chromium.org,bmeurer@chromium.org,szuend@chromium.org
      
      Change-Id: I0bc1f935de6063acf75a0f4bb8c0ba67428603fd
      No-Presubmit: true
      No-Tree-Checks: true
      No-Try: true
      Bug: chromium:951196, chromium:965583, v8:4153, v8:7881, v8:9183
      Cq-Include-Trybots: luci.chromium.try:linux-rel, win7-rel
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1631427Reviewed-by: 's avatarClemens Hammacher <clemensh@chromium.org>
      Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#61856}
      e4db146a
    • Benedikt Meurer's avatar
      [typedarray] Move external/data pointer to JSTypedArray. · 4b86fea5
      Benedikt Meurer authored
      As the next step in supporting huge typed arrays in V8, this moves the
      external/data pointer from the FixedTypedArrayBase backing store to the
      JSTypedArray instance itself, and replaces the special backing stores
      with a plain ByteArray (removing all the code for the FixedTypedArrayBase
      class hierarchy). By doing so, we can drastically simplify the system
      around typed arrays.
      
      Note: Several places in the code base used to check the instance type
      of the elements backing store of a JSTypedArray instead of checking the
      elements kind on the JSTypedArray map directly. Those had to be fixed,
      since the backing store is now always a ByteArray.
      
      Drive-by-fix: Move all the typed elements access related code into the
      elements.cc file to properly encapsulate the accesses.
      
      Doc: http://doc/1Z-wM2qwvAuxH46e9ivtkYvKzzwYZg8ymm0x0wJaomow
      Bug: chromium:951196, chromium:965583, v8:4153, v8:7881, v8:9183
      Change-Id: I8cc06b190c53e34155000b4560f5f3ef40621646
      Cq-Include-Trybots: luci.chromium.try:linux-rel,win7-rel
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627535
      Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
      Reviewed-by: 's avatarPeter Marshall <petermarshall@chromium.org>
      Reviewed-by: 's avatarUlan Degenbaev <ulan@chromium.org>
      Reviewed-by: 's avatarSimon Zünd <szuend@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#61855}
      4b86fea5
  3. 23 May, 2019 2 commits
  4. 20 May, 2019 2 commits
  5. 17 May, 2019 2 commits
  6. 07 May, 2019 1 commit
    • Peter Marshall's avatar
      Reland "[typedarray] Make JSTypedArray::length authoritative." · 330e5ba2
      Peter Marshall authored
      This is a reland of ad44c258
      
      Patchset 2 is the original CL
      Patchset 3 fixes some misuses of FixedArrayBase::length() and adds some
      DCHECKS to flush out any more misuses.
      Patchset 4 adds the PPC/S390 port by miladfar@ca.ibm.com.
      
      Original change's description:
      > [typedarray] Make JSTypedArray::length authoritative.
      >
      > This is the first step towards full huge typed array support in V8.
      > Before this change, the JSTypedArray::length and the elements backing
      > store length (FixedTypedArrayBase::length) were used more or less
      > interchangeably to determine the number of elements in a JSTypedArray.
      >
      > With this change we disentangle these two lengths, and instead make
      > JSTypedArray::length authoritative. For on-heap typed arrays, the
      > FixedTypedArrayBase::length will remain the number of elements in the
      > backing store, but for the off-heap typed arrays, this length will be
      > set to 0 (matching the fact that the FixedTypedArrayBase instance does
      > not contain any elements itself).
      >
      > This also unifies the JSTypedArray::set_/length() and length_value()
      > methods to only have JSTypedArray::set_/length() which returns/takes
      > size_t values. Currently this still requires the values to be in Smi
      > range, but later we will extend this to allow arbitrary size_t values
      > (in the safe integer range).
      >
      > Bug: v8:4153, v8:7881
      > Change-Id: Iff9089130bb31fa9e08e0cf913e7ab52c3dbf107
      > Cq-Include-Trybots: luci.chromium.try:linux-blink-rel
      > Doc: http://doc/1Z-wM2qwvAuxH46e9ivtkYvKzzwYZg8ymm0x0wJaomow
      > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1543729
      > Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
      > Reviewed-by: Peter Marshall <petermarshall@chromium.org>
      > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
      > Reviewed-by: Ben Titzer <titzer@chromium.org>
      > Reviewed-by: Hannes Payer <hpayer@chromium.org>
      > Cr-Commit-Position: refs/heads/master@{#60648}
      
      Bug: v8:4153, v8:7881, v8:9105
      Change-Id: Ic38f833071a723642ebc6f82a4012dbc0878ef98
      Cq-Include-Trybots: luci.chromium.try:linux-blink-rel
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1594435Reviewed-by: 's avatarBenedikt Meurer <bmeurer@chromium.org>
      Reviewed-by: 's avatarHannes Payer <hpayer@chromium.org>
      Commit-Queue: Peter Marshall <petermarshall@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#61275}
      330e5ba2
  7. 02 May, 2019 1 commit
    • Peter Marshall's avatar
      Revert "[typedarray] Make JSTypedArray::length authoritative." · 18100666
      Peter Marshall authored
      This reverts commit ad44c258.
      
      Reason for revert: Missed some users: crbug.com/v8/9105
      
      Original change's description:
      > [typedarray] Make JSTypedArray::length authoritative.
      >
      > This is the first step towards full huge typed array support in V8.
      > Before this change, the JSTypedArray::length and the elements backing
      > store length (FixedTypedArrayBase::length) were used more or less
      > interchangeably to determine the number of elements in a JSTypedArray.
      >
      > With this change we disentangle these two lengths, and instead make
      > JSTypedArray::length authoritative. For on-heap typed arrays, the
      > FixedTypedArrayBase::length will remain the number of elements in the
      > backing store, but for the off-heap typed arrays, this length will be
      > set to 0 (matching the fact that the FixedTypedArrayBase instance does
      > not contain any elements itself).
      >
      > This also unifies the JSTypedArray::set_/length() and length_value()
      > methods to only have JSTypedArray::set_/length() which returns/takes
      > size_t values. Currently this still requires the values to be in Smi
      > range, but later we will extend this to allow arbitrary size_t values
      > (in the safe integer range).
      >
      > Bug: v8:4153, v8:7881
      > Change-Id: Iff9089130bb31fa9e08e0cf913e7ab52c3dbf107
      > Cq-Include-Trybots: luci.chromium.try:linux-blink-rel
      > Doc: http://doc/1Z-wM2qwvAuxH46e9ivtkYvKzzwYZg8ymm0x0wJaomow
      > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1543729
      > Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
      > Reviewed-by: Peter Marshall <petermarshall@chromium.org>
      > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
      > Reviewed-by: Ben Titzer <titzer@chromium.org>
      > Reviewed-by: Hannes Payer <hpayer@chromium.org>
      > Cr-Commit-Position: refs/heads/master@{#60648}
      
      TBR=jarin@chromium.org,titzer@chromium.org,hpayer@chromium.org,petermarshall@chromium.org,bmeurer@chromium.org
      
      # Not skipping CQ checks because original CL landed > 1 day ago.
      
      TBR=jarin@chromium.org, szuend@chromium.org
      
      Bug: v8:4153, v8:7881
      Change-Id: I96992bff15b4a2765ae4a557d2c37e78269c927d
      Cq-Include-Trybots: luci.chromium.try:linux-blink-rel
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1593294
      Commit-Queue: Peter Marshall <petermarshall@chromium.org>
      Reviewed-by: 's avatarJaroslav Sevcik <jarin@chromium.org>
      Reviewed-by: 's avatarPeter Marshall <petermarshall@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#61172}
      18100666
  8. 05 Apr, 2019 1 commit
    • Benedikt Meurer's avatar
      [typedarray] Make JSTypedArray::length authoritative. · ad44c258
      Benedikt Meurer authored
      This is the first step towards full huge typed array support in V8.
      Before this change, the JSTypedArray::length and the elements backing
      store length (FixedTypedArrayBase::length) were used more or less
      interchangeably to determine the number of elements in a JSTypedArray.
      
      With this change we disentangle these two lengths, and instead make
      JSTypedArray::length authoritative. For on-heap typed arrays, the
      FixedTypedArrayBase::length will remain the number of elements in the
      backing store, but for the off-heap typed arrays, this length will be
      set to 0 (matching the fact that the FixedTypedArrayBase instance does
      not contain any elements itself).
      
      This also unifies the JSTypedArray::set_/length() and length_value()
      methods to only have JSTypedArray::set_/length() which returns/takes
      size_t values. Currently this still requires the values to be in Smi
      range, but later we will extend this to allow arbitrary size_t values
      (in the safe integer range).
      
      Bug: v8:4153, v8:7881
      Change-Id: Iff9089130bb31fa9e08e0cf913e7ab52c3dbf107
      Cq-Include-Trybots: luci.chromium.try:linux-blink-rel
      Doc: http://doc/1Z-wM2qwvAuxH46e9ivtkYvKzzwYZg8ymm0x0wJaomow
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1543729
      Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
      Reviewed-by: 's avatarPeter Marshall <petermarshall@chromium.org>
      Reviewed-by: 's avatarJaroslav Sevcik <jarin@chromium.org>
      Reviewed-by: 's avatarBen Titzer <titzer@chromium.org>
      Reviewed-by: 's avatarHannes Payer <hpayer@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#60648}
      ad44c258
  9. 07 Mar, 2019 1 commit
    • Jakob Kummerow's avatar
      [ubsan] Fix various ClusterFuzz-found issues · 91f0cd00
      Jakob Kummerow authored
      Fixing a few float and int overflows.
      Drive-by fix: with --experimental-wasm-bigint, Number values
      may not be used to initialize i64-typed globals. The existing
      code for doing that relied on UB; since it's a spec violation
      the fix is to throw instead.
      
      No regression test for 933103 because it will OOM anyway.
      No regression test for 932896 because it would be extremely slow.
      
      Bug: chromium:927894, chromium:927996, chromium:930086, chromium:932679, chromium:932896, chromium:933103, chromium:933134
      Change-Id: Iae1c1ff1038af4512a52d3e56b8c4b75f2233314
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1495911
      Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
      Reviewed-by: 's avatarMichael Starzinger <mstarzinger@chromium.org>
      Reviewed-by: 's avatarAdam Klein <adamk@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#60075}
      91f0cd00
  10. 17 Dec, 2018 1 commit
  11. 11 Dec, 2018 1 commit
  12. 17 Aug, 2018 1 commit
  13. 03 Aug, 2018 1 commit
  14. 25 Jul, 2018 3 commits
  15. 18 Jul, 2018 1 commit
  16. 13 Jul, 2018 1 commit
  17. 03 Jul, 2018 1 commit
  18. 23 Jun, 2018 1 commit
  19. 18 Apr, 2018 1 commit
    • Simon Zünd's avatar
      Renamed builtins-typedarray* files. · 0ec7e505
      Simon Zünd authored
      This change is in preparation for implementing TypedArray builtins
      in torque. Torque makes assumptions about naming conventions regarding
      file and class names, which are currently inconsistent for TypedArrays.
      The class is called TypedArrayBuiltinsAssembler while the current file
      name suggests Typedarray... .
      
      R=jgruber@chromium.org
      
      Bug: v8:7382
      Change-Id: I3051dacb2bfbb7041482c8aa0a1104776ab4972c
      Reviewed-on: https://chromium-review.googlesource.com/1016300Reviewed-by: 's avatarJakob Gruber <jgruber@chromium.org>
      Commit-Queue: Simon Zünd <szuend@google.com>
      Cr-Commit-Position: refs/heads/master@{#52661}
      0ec7e505
  20. 19 Feb, 2018 1 commit
  21. 17 Feb, 2018 2 commits
  22. 30 Jan, 2018 1 commit
  23. 23 Nov, 2017 1 commit
  24. 23 Oct, 2017 1 commit
  25. 19 Oct, 2017 2 commits
  26. 16 Oct, 2017 1 commit
  27. 04 Sep, 2017 1 commit
  28. 01 Sep, 2017 1 commit
  29. 10 Jul, 2017 1 commit
  30. 17 May, 2017 1 commit
  31. 26 Apr, 2017 1 commit