- 11 Aug, 2017 25 commits
-
-
Benedikt Meurer authored
These operators were only used by the old asm.js pipeline (with fullcodegen and the AstGraphBuilder). When going through the new pipeline, accesses to TypedArrays are handled by the native context specialization during inlining. Bug: v8:6409 Change-Id: Ib9b888c0b96f297a335580ee42dfa951bde566be Reviewed-on: https://chromium-review.googlesource.com/612347Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#47322}
-
Alexey Kozyatinskiy authored
R=dgozman@chromium.org Bug: chromium:754560 Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel Change-Id: I3c0d5c4eebc3e8dbfa6663210046d6a86b1226b5 Reviewed-on: https://chromium-review.googlesource.com/612452Reviewed-by:
Dmitry Gozman <dgozman@chromium.org> Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org> Cr-Commit-Position: refs/heads/master@{#47321}
-
Ross McIlroy authored
Removes the new.target slot from the interpreter's fixed frame. Instead adds a field to BytecodeArray to get the bytecode's incoming new.target or generator object register. The InterpreterEntryTrampoline then sets this register with the incoming new.target (or generator object) when the function is called. This register can be directly the new.target or generator object variable if they are LOCAL location, otherwise it is a temporary register which is then moved to the variable's location during the function prologue. This fixes a hack in the deoptimizer where we would set the new.target fixed slot to undefined in order to avoid extending it's lifetime through the optimized code - now it's just a standard register and can be optimized away as normal. Bug=v8:6644 Change-Id: Ieb8cc34cccefd9fb6634a90cbc77c6002a54f2ae Reviewed-on: https://chromium-review.googlesource.com/608966 Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#47320}
-
Ulan Degenbaev authored
This reverts commit a7c7e8f6. Reason for revert: TSAN failures. Original change's description: > [heap] Handle bytecode arrays in concurrent marker. > > Bytecode array visitor has a side-effect of incrementing the age counter. > > This patch makes the increment atomic and thus safe for the concurrent > marker. > > Bug: chromium:694255 > Change-Id: I36c65b02ace8d366206bd8295e72aaa19742ed56 > Reviewed-on: https://chromium-review.googlesource.com/610001 > Commit-Queue: Ulan Degenbaev <ulan@chromium.org> > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> > Cr-Commit-Position: refs/heads/master@{#47317} TBR=ulan@chromium.org,rmcilroy@chromium.org Change-Id: Iceff1e5925bb6ad7c03f858aa2f1fa62240f6909 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: chromium:694255 Reviewed-on: https://chromium-review.googlesource.com/612069Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#47319}
-
Alexey Kozyatinskiy authored
As long as we have scripts with negative source offset (see inline event listeners) we should not crash a browser when get negative offset. R=jgruber@chromium.org Bug: chromium:750592 Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng Change-Id: Ic3138e7c61ec0a5133c56de9970acdffa5536d8e Reviewed-on: https://chromium-review.googlesource.com/611613Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Yang Guo <yangguo@chromium.org> Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org> Cr-Commit-Position: refs/heads/master@{#47318}
-
Ulan Degenbaev authored
Bytecode array visitor has a side-effect of incrementing the age counter. This patch makes the increment atomic and thus safe for the concurrent marker. Bug: chromium:694255 Change-Id: I36c65b02ace8d366206bd8295e72aaa19742ed56 Reviewed-on: https://chromium-review.googlesource.com/610001 Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#47317}
-
Jakob Kummerow authored
It expected its argument to be a JSFunction, but fuzzer tests can pass anything. Non-JSFunction arguments should just silently be ignored, just like similar CF-whitelisted runtime functions do. Bug: chromium:754177 Change-Id: I41b29528bbe72f24b3d84f021b22602160769d26 Reviewed-on: https://chromium-review.googlesource.com/610706Reviewed-by:
-
Ulan Degenbaev authored
Shared function info marking is now side-effect free, so can be handled by base HeapVisitor. Concurrent marker does not bailout on shared function infos. Bug: chromium:694255 Change-Id: I41efece68f6758219fca318deb97a7f163ee9638 Reviewed-on: https://chromium-review.googlesource.com/608700 Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/master@{#47315}
-
Ulan Degenbaev authored
Change-Id: I91bae96b82078a310b67707f98fb257896e3e00f Reviewed-on: https://chromium-review.googlesource.com/612083Reviewed-by:
-
Georg Neis authored
R=marja@chromium.org Bug: Change-Id: I641ca830bb11b91e7098ee8d2dbec5d523bbc879 Reviewed-on: https://chromium-review.googlesource.com/612082Reviewed-by:
Marja Hölttä <marja@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#47313}
-
Georg Neis authored
R=marja@chromium.org Bug: Change-Id: Ic7a2fc28baa5ecf0650287fbc193ff0eccbf2f5e Reviewed-on: https://chromium-review.googlesource.com/612248Reviewed-by:
-
Ulan Degenbaev authored
This class provides byte level CAS operation using word level CAS. Bug: chromium:694255 Change-Id: I39e661ee8d11e3f61fd5cb64c36f8f5ee94d1244 Reviewed-on: https://chromium-review.googlesource.com/612170 Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
-
Tobias Tebbi authored
This improves compiler performance of the new escape analysis: runtime reduced by ~10% and zone memory reduced by ~40%. Bug: Change-Id: I6b9eeaecfee6faef616d5cb8fed57fd41856898b Reviewed-on: https://chromium-review.googlesource.com/611902 Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Reviewed-by:
-
Benedikt Meurer authored
R=mstarzinger@chromium.org Bug: v8:6409 Change-Id: I676a61593a5b5e5df50990ded6f1882d8b7d0159 Reviewed-on: https://chromium-review.googlesource.com/612280Reviewed-by:
-
Michael Starzinger authored
R=bmeurer@chromium.org TEST=cctest/test-api/ReceiverSignature Change-Id: I4f58d7a1ce15aa02b1fec5c0317733d3f3b1f4ef Reviewed-on: https://chromium-review.googlesource.com/611990Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#47308}
-
Ross McIlroy authored
Deletes the now unused Full-codegen compiler. Also removes some macro assembler instructions which are no longer used. Note: there is still additional cleanup work to do after this lands (e.g., remove support for FCG frames support and FCG debugger support, etc.), but this will be done in followup CLs to keep this patch managable. BUG=v8:6409 Change-Id: I8d828fe7a64d29f2c1252d5fda968a630a2e9ef2 Reviewed-on: https://chromium-review.googlesource.com/584773 Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
-
Ulan Degenbaev authored
This fixes the UBSAN failures on the bot. Bug: chromium:694255 Change-Id: I7fc169bc526e71444ce52eba0285a8cafe9d902d Reviewed-on: https://chromium-review.googlesource.com/612167Reviewed-by:
-
Michael Lippautz authored
- Move into v8::internal::heap namespace - Remove card marking ifdefs Bug: Change-Id: Ifd5e5d96c6ab0fea85a3646e5b307583eb13e2c3 Reviewed-on: https://chromium-review.googlesource.com/612066Reviewed-by:
-
Michael Lippautz authored
The removed building blocks have either been completely unused or have already been replaced. Bug: Change-Id: I68a4d5d42b7f1cc3c5f8d0e7ea7146c5a0f59048 Reviewed-on: https://chromium-review.googlesource.com/612163Reviewed-by:
-
Ulan Degenbaev authored
This allows handling transitions arrays in concurrent marking Bug: chromium:694255 Change-Id: I28196fccbf03bfba7d7dada1884813be372ddb54 Reviewed-on: https://chromium-review.googlesource.com/610961 Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
-
Benedikt Meurer authored
For Divide operations like r = a / b where r has only truncated uses (i.e. only used in bitwise operations), we used to generate a Float64Div unless we statically knew something about a and b, even if a and b have always been integers so far. Crankshaft was able to generate an integer division here, because Fullcodegen collected feedback independently for inputs and outputs of binary operations. This adds new BinaryOperationFeedback::kSignedSmallInputs, which is used specifically for Divide to state that we have seen only SignedSmall inputs thus far, but the outputs weren't always in the SignedSmall range. The issue was discovered in a WebGL Triangulation library and reported via https://twitter.com/mourner/status/895708603117518848 after Node 8.3.0 was released with I+TF. R=jarin@chromium.org Bug: v8:6698 Change-Id: I830e421a3bf91fc8fa3665cbb706bc13675a6d2b Reviewed-on: https://chromium-review.googlesource.com/612063 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
-
Michael Starzinger authored
This changes the baseline of an inspector test setting breakpoints within an asm.js module while the module is being executed. With the validator it is not supported to switch from active WebAssembly code back to debuggable interpreter code. Hence some previously expected breakpoints no longer fire, the behavior is consistent across all configurations now though. R=yangguo@chromium.org TEST=inspector/debugger/asm-js-breakpoint-during-exec BUG=v8:6166 Change-Id: Ie1bb62fa6df28b10336b4cb5d381d2141eec356c Reviewed-on: https://chromium-review.googlesource.com/608977Reviewed-by:
-
Ulan Degenbaev authored
This reverts commit 3f820ebb. Revert "[heap, runtime] Avoid redundant clearing of slots in a trimmed array." This reverts commit ed76f17b. Reason: canary crashes. Bug: chromium:752750, chromium:694255 TBR: mlippautz@chromium.org Change-Id: I57c533e8a3db5f28e7659c5f326fa343627a3ff7 Reviewed-on: https://chromium-review.googlesource.com/607868Reviewed-by:
-
Maya Lekova authored
This is a reland of edc4ae14 With fixes for crbug.com/752846, crbug.com/752712, crbug.com/752850 Previously landed as: 47a97aa5 / 47113 Previously landed as: 15ef03cb / 47159 Previously landed as: e86c066b / 47235 Previously landed as: edc4ae14 / 47245 TBR=jkummerow@chromium.org, franzih@chromium.org, bmeurer@chromium.org, jgruber@chromium.org, mstarzinger@chromium.org Bug: v8:6559, v8:6557 Change-Id: I956486e90aab36ba95676bd4ec2febebed509fc1 Reviewed-on: https://chromium-review.googlesource.com/609781Reviewed-by:
Georg Neis <neis@chromium.org> Reviewed-by:
Franziska Hinkelmann <franzih@chromium.org> Commit-Queue: Maya Lekova <mslekova@google.com> Cr-Commit-Position: refs/heads/master@{#47299}
-
v8-autoroll authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/b6996c4..7c87e0e Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/bd05965..0eeb5ba TBR=machenbach@chromium.org,hablich@chromium.org Change-Id: I23ee429028dc94d66332ad1e624b95e46a459441 Reviewed-on: https://chromium-review.googlesource.com/611661Reviewed-by:
v8 autoroll <v8-autoroll@chromium.org> Commit-Queue: v8 autoroll <v8-autoroll@chromium.org> Cr-Commit-Position: refs/heads/master@{#47298}
-
- 10 Aug, 2017 15 commits
-
-
Sathya Gunasekaran authored
Bug: v8:4643 Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng Change-Id: Id82365d20830e5efd33a8d066f5aab4b999807d7 Reviewed-on: https://chromium-review.googlesource.com/611180Reviewed-by:
Adam Klein <adamk@chromium.org> Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org> Cr-Commit-Position: refs/heads/master@{#47297}
-
Mircea Trofin authored
The compiler patches all call sites with a default code object value. We used to populate a vector with that value. Turns out that avoiding having that vector measurably reduces instantiation time. Bug: Change-Id: I2c843210a2ab24541f370b5493c3cbb555149e1a Reviewed-on: https://chromium-review.googlesource.com/609480 Commit-Queue: Mircea Trofin <mtrofin@chromium.org> Reviewed-by:
Brad Nelson <bradnelson@chromium.org> Reviewed-by:
Ben Titzer <titzer@chromium.org> Cr-Commit-Position: refs/heads/master@{#47296}
-
Ulan Degenbaev authored
Bug: chromium:694255 TBR: mlippautz@chromium.org No-Tree-Checks: true No-Try: true Change-Id: I720dcc79c4cb8c1cbd7dd6e6de4c6113c363b2f0 Reviewed-on: https://chromium-review.googlesource.com/610561 Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
-
Eric Holk authored
Bug: Change-Id: I1ab93d5b2d02d9a4851c2e67d33968a7cafaedd3 Reviewed-on: https://chromium-review.googlesource.com/610892Reviewed-by:
-
Ulan Degenbaev authored
Bug: chromium:694255 TBR: mlippautz@chromium.org Change-Id: Ie9f2f7bff8ada297b1d078947f073eaf62ac0649 Reviewed-on: https://chromium-review.googlesource.com/610782Reviewed-by:
-
Michael Lippautz authored
Bug: chromium:750084 Change-Id: I3c0059f1e986b5e4400f84f44b7f179e7232eae1 Reviewed-on: https://chromium-review.googlesource.com/610781 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
-
Adam Klein authored
PatternRewriter is an implementation detail of the Parser; as such, there's no need for it to be exposed in parser.h (or even to most of the Parser). This patch is a cleanup that hides all of PatternRewriter in pattern-rewriter.cc, exposing only the few helper methods needed by the rest of Parser in parser.h. Also removed some duplication between the two PatternRewriter initialization functions by adding a constructor, and added a few DCHECKs here and there. Change-Id: I1dbae8dc0172ff16e40585d0e718d206d2075b3a Reviewed-on: https://chromium-review.googlesource.com/609365Reviewed-by:
-
Maya Lekova authored
Add additional tests for Proxy get and has property. Bug: v8:6560, v8:6557 Change-Id: I56360c230b03a16425f4068d8023f90b3164eebb Reviewed-on: https://chromium-review.googlesource.com/607889 Commit-Queue: Maya Lekova <mslekova@google.com> Reviewed-by:
-
Ulan Degenbaev authored
This partially relands b35a0789. Bug: chromium:752426 Change-Id: Ia6f9853115278109189291bca92e94974cfe35b0 Reviewed-on: https://chromium-review.googlesource.com/610580Reviewed-by:
-
Ulan Degenbaev authored
This patch merges ObjectMarking and MarkingState. The new marking state encapsulates object marking, live byte tracking, and access atomicity. The old ObjectMarking calls are now replaced with calls to marking state. For example: ObjectMarking::WhiteToGrey<kAtomicity>(obj, marking_state(obj) becomes marking_state()->WhiteToGrey(obj) This simplifies custom handling of live bytes and allows to chose atomicity of markbit accesses depending on collector's state. This also decouples marking bitmap from the marking code, which will allows in future to use different data-structure for mark-bits. Bug: chromium:694255 Change-Id: Ifb4bc0144187bac1c08f6bc74a9d5c618fe77740 Reviewed-on: https://chromium-review.googlesource.com/602132 Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
-
Ulan Degenbaev authored
Bug: chromium:752461 Change-Id: Ie70a4ed1314e040d0edecece6a1dca7b1fc8d001 Reviewed-on: https://chromium-review.googlesource.com/610083Reviewed-by:
-
Mircea Trofin authored
Bug: Change-Id: Ia8fd50cad1c7d0dd82eeadb22807e301246423a8 Reviewed-on: https://chromium-review.googlesource.com/610309Reviewed-by:
-
Mythri authored
Inline only if there is some additional budget left even after inlining the current candidate. This allows any small functions exposed by this function to be inlined. Earlier we used to check for the limit after inlining the function. Bug: v8:6682 Change-Id: Ia3931751f212e89ca6d9c8500c6b3a909f12d962 Reviewed-on: https://chromium-review.googlesource.com/608970Reviewed-by:
-
Ross McIlroy authored
Deletes AstGraphBuilder and associated classes now that it is unreachable. The following classes are also removed: - ControlBuilders - JSFrameSpecialization - AstLoopAssignmentAnalysis Also removes flags from compilation-info which are no longer used, and removes the no-deoptimization paths from TypedOptimization, JsTypedLowering, JSIntrinsicLowering and JSBuiltinLowering. BUG=v8:6409 Change-Id: I63986e8e3497bf63c4a27ea8ae827b8a633d4a26 Reviewed-on: https://chromium-review.googlesource.com/583652 Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
-
Leszek Swirski authored
Rather than lumping in parsing, bytecode compilation and optimized compilation all into the same VM "compile" state, seperate them out into individual states. Additionally, add support for these states to tickprocessor and profview. Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng Change-Id: I5be943e23cae042e32e9ccb24415c67c18658b4b Reviewed-on: https://chromium-review.googlesource.com/608973 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
-
