- 17 Apr, 2018 14 commits
-
-
Georg Neis authored
Throw a TypeError if the length of a concat-spreadable object makes the total length too large, as specified. Bug: v8:7652 Change-Id: Ie3f694d64c949703edd733c0310cfb3f64b78a15 Reviewed-on: https://chromium-review.googlesource.com/1013714Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#52644}
-
Yang Guo authored
Flattening the string upfront has performance benefits and we can also simplify the implementation quite a bit. Bug: v8:6780 Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng Change-Id: Ic75bdfdf900d30e51e95cdf1cb8d09aab06332c6 Reviewed-on: https://chromium-review.googlesource.com/1014102Reviewed-by:
Marja Hölttä <marja@chromium.org> Reviewed-by:
Mathias Bynens <mathias@chromium.org> Commit-Queue: Yang Guo <yangguo@chromium.org> Cr-Commit-Position: refs/heads/master@{#52643}
-
sreten.kovacevic authored
Refactor AddPair and SubPair Macro-assembler instructions to prevent register overwriting, refactor all the places where these instructions are used. Also, implement MulPair instruction. Change-Id: I3f8f9d5fe6fa5bf25df3446614ac311cf886b6ac Reviewed-on: https://chromium-review.googlesource.com/1013571Reviewed-by:
Ivica Bogosavljevic <ivica.bogosavljevic@mips.com> Commit-Queue: Sreten Kovacevic <sreten.kovacevic@mips.com> Cr-Commit-Position: refs/heads/master@{#52642}
-
Sigurd Schneider authored
This is a reland of 370d95dc Original change's description: > [turbofan] Enable Promise constructor inlining by default > > Bug: v8:7584 > Change-Id: I7443c28c74676ee1f27550674c8f712594e21cc7 > Reviewed-on: https://chromium-review.googlesource.com/992314 > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> > Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> > Commit-Queue: Sigurd Schneider <sigurds@chromium.org> > Cr-Commit-Position: refs/heads/master@{#52341} Bug: v8:7584 Change-Id: Ie33b89bf8bb7abde426d477a8b39914e6d90e5b6 Reviewed-on: https://chromium-review.googlesource.com/1009862 Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#52641}
-
jgruber authored
TBR=yangguo@chromium.org No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:6666 Change-Id: I051dd5a1578d2e611f4b6351aa9cff9451494a5c Reviewed-on: https://chromium-review.googlesource.com/1013711 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#52640}
-
Sergiy Byelozyorov authored
R=machenbach@chromium.org No-Try: true Bug: chromium:793687 Change-Id: I6d2988a0a2644de806e7b273ed5ff9213fceda5d Reviewed-on: https://chromium-review.googlesource.com/1013708 Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org> Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/master@{#52639}
-
Dan Elphick authored
This is a reland of f8ae62fe Original change's description: > [heap] Move initial objects into RO_SPACE > > This moves: > * the main oddballs (null, undefined, hole, true, false) as well as > their supporting maps (also adds hole as an internalized string to make > this work). > * most of the internalized strings > * the struct maps > * empty array > * empty enum cache > * the contents of the initial string table > * the weak_cell_cache for any map in RO_SPACE (and eagerly creates the > value avoid writing to it during run-time) > > The StartupSerializer stats change as follows: > > RO_SPACE NEW_SPACE OLD_SPACE CODE_SPACE MAP_SPACE LO_SPACE > old 0 0 270264 32608 12144 0 > new 21776 0 253168 32608 8184 0 > Overall memory usage has increased by 720 bytes due to the eager > initialization of the Map weak cell caches. > > Also extends --serialization-statistics to print out separate instance > type stats for objects in RO_SPACE as shown here: > > Read Only Instance types (count and bytes): > 404 16736 ONE_BYTE_INTERNALIZED_STRING_TYPE > 2 32 HEAP_NUMBER_TYPE > 5 240 ODDBALL_TYPE > 45 3960 MAP_TYPE > 1 16 BYTE_ARRAY_TYPE > 1 24 TUPLE2_TYPE > 1 16 FIXED_ARRAY_TYPE > 1 32 DESCRIPTOR_ARRAY_TYPE > 45 720 WEAK_CELL_TYPE > > Bug: v8:7464 > Change-Id: I12981c39c82a7057f68bbbe03f89fb57b0b4c6a6 > Reviewed-on: https://chromium-review.googlesource.com/973722 > Commit-Queue: Dan Elphick <delphick@chromium.org> > Reviewed-by: Hannes Payer <hpayer@chromium.org> > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> > Reviewed-by: Yang Guo <yangguo@chromium.org> > Cr-Commit-Position: refs/heads/master@{#52435} Bug: v8:7464 Change-Id: I50427edfeb53ca80ec4cf46566368fb2213ccf7b Reviewed-on: https://chromium-review.googlesource.com/999654 Commit-Queue: Dan Elphick <delphick@chromium.org> Reviewed-by:
Yang Guo <yangguo@chromium.org> Reviewed-by:
Hannes Payer <hpayer@chromium.org> Cr-Commit-Position: refs/heads/master@{#52638}
-
jgruber authored
Re-enable embedded builtins now that 67 has branched. This reverts two CLs: Disable embedded builtins for M67 branch point https://chromium-review.googlesource.com/c/v8/v8/+/982053 Enable embedded builtins on two bots https://chromium-review.googlesource.com/c/v8/v8/+/983597 And partially: Mark embedded builtins builds as non-shipping https://chromium-review.googlesource.com/1005515 Bug: v8:6666 Change-Id: I8e12e99bd1ec6567baf25545147337b6a0127e2a Reviewed-on: https://chromium-review.googlesource.com/1013570 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Michael Hablich <hablich@chromium.org> Cr-Commit-Position: refs/heads/master@{#52637}
-
Dan Elphick authored
Add a new permission kRead to PageAllocator::Permission and OS::MemoryPermission and implement it in platform-*. Not used yet, because it needs corresponding changes in chromium. Bug: v8:7464 Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng Change-Id: I9f84251eff593536cbcc1cde04641d696c79d65c Reviewed-on: https://chromium-review.googlesource.com/1006756Reviewed-by:
-
Sergiy Byelozyorov authored
R=machenbach@chromium.org No-Try: true Bug: chromium:793687 Change-Id: If4f125a0c1a2b818cdcc61200b14b73f56f65507 Reviewed-on: https://chromium-review.googlesource.com/1013523 Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org> Reviewed-by:
-
Clemens Hammacher authored
Consolidate nearly identical implementations and move them to TurboAssembler, such that they can be reused for Liftoff. R=neis@chromium.org Bug: v8:6600 Change-Id: I197445404df033ac1a05f4aa88501263ae4b75f3 Reviewed-on: https://chromium-review.googlesource.com/1013561 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#52634}
-
Clemens Hammacher authored
Make values which are referenced via ExternalReference constexpr, and initialize them statically. This avoids dynamic initialization and protects them against being overwritten from generated code. R=neis@chromium.org Bug: v8:7570 Change-Id: I1c6c10fbffea12dc1f5bf726313bf8388e6530a1 Reviewed-on: https://chromium-review.googlesource.com/1013518Reviewed-by:
-
Jakob Kummerow authored
This doesn't change the API, it just makes it functional: the functions were declared already, but they lacked an implementation so far. Trying to use them in Blink detects that issue. Bug: v8:6791 Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng Change-Id: I48902a5bba4a42f2922eafd22858d584731fc777 Reviewed-on: https://chromium-review.googlesource.com/1014668Reviewed-by:
Daniel Clifford <danno@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#52632}
-
Jakob Kummerow authored
Casting from a floating-point type to an integer type is undefined behavior if the integral part of the float cannot be represented in the range of the int. Bug: v8:3770, chromium:831145 Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux_noi18n_rel_ng Change-Id: I2e85ea8b0f09bbeeb3e0dcc1135fc747fa312f6d Reviewed-on: https://chromium-review.googlesource.com/1011651 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/master@{#52631}
-
- 16 Apr, 2018 21 commits
-
-
Camillo Bruni authored
Bug: chromium:831984 Change-Id: Ie13b22bc2491acc255557ba0325d8d53c22d6acb Reviewed-on: https://chromium-review.googlesource.com/1012874Reviewed-by:
Igor Sheludko <ishell@chromium.org> Commit-Queue: Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/master@{#52630}
-
Ben L. Titzer authored
Now that tables and stack frames properly root instances, there is no longer any need to disallow mutations that could unroot instances while their code is on the stack. Bug: v8:7232 Change-Id: I907b9522ac12ad7a67fb4124774713b6b3b40bb7 Reviewed-on: https://chromium-review.googlesource.com/1007004 Commit-Queue: Ben Titzer <titzer@chromium.org> Reviewed-by:
-
Michael Starzinger authored
This removes the support to serialize copies of {CodeStub} codes during native module serialization. It is still possible to serialize builtins and all code objects copied from the GC heap are builtins by now. R=ahaas@chromium.org Change-Id: If009a82a9d7c7080f70f344040ebb91f20b8cc1a Reviewed-on: https://chromium-review.googlesource.com/1012081 Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by:Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/master@{#52628}
-
Eric Holk authored
This will give us much better testing coverage for trap-based bounds checks. Note that this will not enable the trap handler by default in Chrome. Instead, Chrome will need to explicitly enable the feature using V8::EnableWebAssemblyTrapHandler. Bug: v8:5277 Change-Id: I7d81f40c6f831c6fe7926375c677908952b78fa2 Reviewed-on: https://chromium-review.googlesource.com/964711Reviewed-by:
Ben Titzer <titzer@chromium.org> Commit-Queue: Eric Holk <eholk@chromium.org> Cr-Commit-Position: refs/heads/master@{#52627}
-
Michael Starzinger authored
This adds another fixed spill slot to the {WasmCompiledFrame} layout, holding a reference to the current {WasmInstanceObject}. This slot allows the stack walker to retrieve instances for WebAssembly frames without having each code object be coupled to an instance. Hence it enables sharing code across instances in the future. R=titzer@chromium.org BUG=v8:7424 Change-Id: I7fa095c6255754caf564edce4ee7e84dea666783 Reviewed-on: https://chromium-review.googlesource.com/1005516 Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by:Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#52626}
-
Clemens Hammacher authored
The Cvtui2ss method did overwrite the {src} register, and the given {tmp} register. Because of this, the Turbofan code generator passed two temporary registers. This CL fixes this to avoid the overwrite of the {src} register (which is now an Operand). R=neis@chromium.org Change-Id: I33e523ac3d7bb377899739e95058b87adefa6b65 Reviewed-on: https://chromium-review.googlesource.com/1014082 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by: -
Georg Neis authored
If the new length is too large, we must throw a TypeError. Bug: v8:7652 Change-Id: I47268c04405f7a5f5bbc971cd434f2d786af9ca1 Reviewed-on: https://chromium-review.googlesource.com/1013563Reviewed-by:
-
Ivo Markovic authored
At is used in Macro Assembler, so we need other registers to hold temporary values. Change-Id: Iffeddba7b3319666a605eea62ecc3cd01b065ad7 Reviewed-on: https://chromium-review.googlesource.com/1013978Reviewed-by:
-
Vincent Belliard authored
First version which can compile a very basic code. Change-Id: I3b98412a5ca39a28f8fe5b60516b82c6981dd187 Reviewed-on: https://chromium-review.googlesource.com/993232 Commit-Queue: Vincent Belliard <vincent.belliard@arm.com> Reviewed-by:
-
Michael Achenbach authored
NOTRY=true TBR=sergiyb@chromium.org Change-Id: I285b32a5acbc302c29ca6085ab6998dbb1609539 Reviewed-on: https://chromium-review.googlesource.com/1013568 Commit-Queue: Michael Achenbach <machenbach@chromium.org> Reviewed-by:
Sergiy Byelozyorov <sergiyb@chromium.org> Reviewed-by:
-
Clemens Hammacher authored
Name type conversions from int to float and vice versa consistently, and move them to the TurboAssembler, such that we can reuse them for Liftoff. R=jarin@chromium.org Bug: v8:6600 Change-Id: Idced658a228eeb611dd4785aa277bd758c201eea Reviewed-on: https://chromium-review.googlesource.com/1014037Reviewed-by:
-
Michael Achenbach authored
Change-Id: I6a97005943b36c0dab70fe8f18bbfcab443c3e03 Reviewed-on: https://chromium-review.googlesource.com/1013566 Commit-Queue: Michael Achenbach <machenbach@chromium.org> Reviewed-by:
-
Daniel Clifford authored
An overview of motivation behind Torque and some of its principles can be found here: https://bit.ly/2qAI5Ep Note that there is quite a bit of work left to do in order to get Torque production-ready for any non-trivial amount of code, but landing the prototype as-is will allow for much faster iteration. Bugs will be filed for all of the big-ticket items that are not landing blockers but called out in this patch as important to fix. Cq-Include-Trybots: luci.v8.try:v8_linux_nosnap_rel;luci.v8.try:v8_linux_noi18n_rel_ng Change-Id: Ib07af70966d5133dc57344928885478b9c6b8b73 Reviewed-on: https://chromium-review.googlesource.com/845682 Commit-Queue: Daniel Clifford <danno@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#52618}
-
sreten.kovacevic authored
Implement i64 binops (`add`, `sub`, `mul`, `and`, `or` and `xor` on MIPS64 and `add`, `mul` and `sub` on MIPS). Bug: v8:6600 Change-Id: I96640a6b4420789f075b1d919789a72163c954d2 Reviewed-on: https://chromium-review.googlesource.com/1010203 Commit-Queue: Sreten Kovacevic <sreten.kovacevic@mips.com> Reviewed-by:
-
Georg Neis authored
The recent changes related to the Address type broke this. R=bmeurer@chromium.org Change-Id: I404930435e9f48750a735beed7d79108b9cc96ee Reviewed-on: https://chromium-review.googlesource.com/1014081 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
-
Dan Elphick authored
Previously Isolate and Factory relied on the undefined behavior of reinterpret_cast to switch between the two unrelated classes (which worked because Factory had no data members). With Isolate inheriting from Factory, it's now possible to switch between the two classes using c-style casts. These are allowed under the C++ standard. The inheritance is private which allows the continuing separation of the Factory and Isolate namespaces. This is a defensive clean-up, since ubsan does not yet detect the previous undefined behavior. Bug: v8:3770 Change-Id: I0ccf09f1d34f747550812ce698ab7e182812409e Reviewed-on: https://chromium-review.googlesource.com/1010122Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Commit-Queue: Dan Elphick <delphick@chromium.org> Cr-Commit-Position: refs/heads/master@{#52615}
-
Yang Guo authored
The embedder should not need to keep track of the source string. R=jgruber@chromium.org Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng Change-Id: Ie27df755a22fbcae7b6e87a435419d2d8f545558 Reviewed-on: https://chromium-review.googlesource.com/1013482Reviewed-by:
-
Marja Hölttä authored
BUG=v8:7308 Change-Id: I5e9f371b1db5515b723d9a2864bf2038706e2015 Reviewed-on: https://chromium-review.googlesource.com/960032 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by:
-
Simon Zünd authored
This adds tests for 'oddly' behaving comparison functions. I.e. functions that cause an element kind change and/or modify the array. The tests check that sort does not crash in these instances. R=jgruber@chromium.org Bug: v8:7382 Change-Id: I4ac9aa081fda9088d1848a960dc66aba671872e5 Reviewed-on: https://chromium-review.googlesource.com/1010062 Commit-Queue: Simon Zünd <szuend@google.com> Reviewed-by:
-
Jakob Kummerow authored
Spec change: https://github.com/tc39/proposal-bigint/pull/138 Bug: v8:6791 Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng Change-Id: I7367273ed1e98971be3b277f6486333a96412185 Reviewed-on: https://chromium-review.googlesource.com/1004120 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
-
Igor Sheludko authored
Bug: v8:5988 Change-Id: I2e90ed8df6b966e04299774e50aeb2913a8c1922 Reviewed-on: https://chromium-review.googlesource.com/999603 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#52610}
-
- 15 Apr, 2018 1 commit
-
-
Jakob Kummerow authored
Per the spec change at [1], Abstract Relational Comparison between a BigInt and a String converts the String to BigInt via StringToBigInt before performing the comparison. Before this change, the String was converted to a Number, and a BigInt/Number comparison was performed. [1] https://github.com/tc39/proposal-bigint/pull/139 Bug: v8:6791 Change-Id: I40b4f4ddc78977adb0d44180eb58e0f9a8a70cb6 Reviewed-on: https://chromium-review.googlesource.com/1004117 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
-
- 14 Apr, 2018 4 commits
-
-
Ben L. Titzer authored
R=gdeepti@chromium.org Change-Id: I3d0a21c6db671718b9f41fb8392f6900b2fecf27 Reviewed-on: https://chromium-review.googlesource.com/1013197Reviewed-by:
Deepti Gandluri <gdeepti@chromium.org> Commit-Queue: Ben Titzer <titzer@chromium.org> Cr-Commit-Position: refs/heads/master@{#52608}
-
Junliang Yan authored
Port 2459046c Original Commit Message: The "Address" type is V8's general-purpose type for manipulating memory addresses. Per the C++ spec, pointer arithmetic and pointer comparisons are undefined behavior except within the same array; since we generally don't operate within a C++ array, our general-purpose type shouldn't be a pointer type. R=jkummerow@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com BUG= LOG=N Change-Id: Ic30ef19019e5b39b01f90587011c6a1b06c4b7a1 Reviewed-on: https://chromium-review.googlesource.com/1012461Reviewed-by:
Junliang Yan <jyan@ca.ibm.com> Commit-Queue: Junliang Yan <jyan@ca.ibm.com> Cr-Commit-Position: refs/heads/master@{#52607}
-
Junliang Yan authored
Port a3b60675 Original Commit Message: This is mostly a simple copy & paste of the stub implementation from code-stubs-arch.cc to builtins-arch.cc. The conversion allows removal of a special case for the DoubleToIStub within the compiler & wasm pipelines, and also makes the following builtins isolate-independent (in conjunction with https://crrev.com/c/1006581): TFC BitwiseAnd TFC BitwiseOr TFC BitwiseXor TFC Exponentiate TFC ShiftLeft TFC ShiftRight TFC ShiftRightLogical TFJ AtomicsAdd TFJ AtomicsAnd TFJ AtomicsCompareExchange TFJ AtomicsExchange TFJ AtomicsLoad TFJ AtomicsOr TFJ AtomicsStore TFJ AtomicsSub TFJ AtomicsXor TFJ MathClz32 TFJ MathImul TFJ MathPow TFJ NumberParseInt TFJ StringFromCharCode TFJ TypedArrayFrom TFJ TypedArrayOf TFJ TypedArrayPrototypeMap R=jgruber@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com BUG= LOG=N Change-Id: Iee9fc5671646772625556717db052b78089c5c66 Reviewed-on: https://chromium-review.googlesource.com/1013247Reviewed-by:
-
Junliang Yan authored
Port 87557649 Original Commit Message: This changes DoubleToIStub to return its result on the stack instead of a specific return register. In a follow-up, the DoubleToIStub could be converted into a builtin. R=jgruber@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com BUG= LOG=N Change-Id: I952fec4fbe004e2734a84ba853f4f5a33c8dd8ce Reviewed-on: https://chromium-review.googlesource.com/1013418Reviewed-by:
-
