- 06 Nov, 2018 17 commits
-
-
Mike Stanton authored
Bug: v8:8418 Change-Id: I6d2efdf87bb4fc5454e5a4ee8e5a66463533615e Reviewed-on: https://chromium-review.googlesource.com/c/1317810 Commit-Queue: Michael Stanton <mvstanton@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#57273}
-
Yang Guo authored
This is to ensure the snapshot is deterministic. Internal fields can contain: - reference to heap object - embedder-defined aligned pointer - a smi The latter two are not distinguishable by V8, so if the serializer callback returns non-zero value, we consider it to be an aligned pointer and clear it to ensure that the snapshot does not contain memory addresses that may not be deterministic. If the callback returns { nullptr, 0 } as result, we consider it to be a smi or some in-place data that we then serialize verbatim. R=jgruber@chromium.org Bug: chromium:870584 Change-Id: I3cf9abf135ffd28d8138fa32636b12596b076e13 Reviewed-on: https://chromium-review.googlesource.com/c/1304441 Commit-Queue: Yang Guo <yangguo@chromium.org> Reviewed-by:Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
-
Peter Marshall authored
Causing ASAN failures Bug: v8:5193 Change-Id: I7a899a6390bd1258a1afc8738e85f73239f44a59 Reviewed-on: https://chromium-review.googlesource.com/c/1319583Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Commit-Queue: Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#57271}
-
Daniel Clifford authored
This is a reland of c88994f8 Turned out to not be the issue. Original change's description: > Fix Array.prototype.sort speed regression > > CanUseSameAccessor<ElementsAccessor: type> is array-sort.tq is super > performance-critical. Reverting the type-safe cleanup made in this > function while landing Array.prototype.slice. > > Bug=chromium:852764 > > Change-Id: I1252d2ff8e431581f916794807e59abb39248abb > Reviewed-on: https://chromium-review.googlesource.com/c/1317815 > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > Commit-Queue: Daniel Clifford <danno@chromium.org> > Cr-Commit-Position: refs/heads/master@{#57248} TBR=danno@chromium.org Change-Id: I627a131a8525ae4e131c6467561cab9832f3792f Reviewed-on: https://chromium-review.googlesource.com/c/1319581Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/master@{#57270}
-
Georg Neis authored
Bug: chromium:901944 Change-Id: Iaf1dfaa5763162ae7952381fb8b64661d85ea1a8 Reviewed-on: https://chromium-review.googlesource.com/c/1317822Reviewed-by:
Sigurd Schneider <sigurds@chromium.org> Reviewed-by:
-
Toon Verwaest authored
Change-Id: Iefea33f47ee4492c9c4d4e105e30f7e2d9128bc7 Reviewed-on: https://chromium-review.googlesource.com/c/1319576Reviewed-by:
-
Sigurd Schneider authored
Notry: true Change-Id: Iacc8aadc62956cf5fab13c60a9eaa52318519d62 Bug: v8:7327 Reviewed-on: https://chromium-review.googlesource.com/c/1317813 Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Reviewed-by:
Stephan Herhut <herhut@chromium.org> Cr-Commit-Position: refs/heads/master@{#57267}
-
Michael Achenbach authored
NOTRY=true TBR=sergiyb@chromium.org Bug: v8:8421 Change-Id: Ifbc7271da8a210b197b698f92aad925d3adf7244 Reviewed-on: https://chromium-review.googlesource.com/c/1319579 Commit-Queue: Michael Achenbach <machenbach@chromium.org> Reviewed-by:
-
Leszek Swirski authored
This reverts commit c88994f8. Reason for revert: Seems to break AccessibilitySelectionTest.List in webkit_unit_tests (https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8-Blink%20Mac/15618) Original change's description: > Fix Array.prototype.sort speed regression > > CanUseSameAccessor<ElementsAccessor: type> is array-sort.tq is super > performance-critical. Reverting the type-safe cleanup made in this > function while landing Array.prototype.slice. > > Bug=chromium:852764 > > Change-Id: I1252d2ff8e431581f916794807e59abb39248abb > Reviewed-on: https://chromium-review.googlesource.com/c/1317815 > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > Commit-Queue: Daniel Clifford <danno@chromium.org> > Cr-Commit-Position: refs/heads/master@{#57248} TBR=danno@chromium.org,jgruber@chromium.org Change-Id: Ie447fd0382fee344326d928398595aa450ccdcca No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/1319577Reviewed-by:
-
Toon Verwaest authored
This rethrows the underlying expression error if there is one. Bug: v8:8409 Change-Id: Icc8253e4006c554df9f6a6d850b087b03d88de2d Reviewed-on: https://chromium-review.googlesource.com/c/1319570Reviewed-by:
-
Clemens Hammacher authored
Instead of passing and storing uint8_t* and size_t, we now more often store a Vector or OwnedVector, which encapsulates these two fields. This provides some more DCHECKs which happen automatically when getting a subvector into the buffer. Drive-by: More refactorings and removals of unneeded or rarely used helper methods. R=ahaas@chromium.org Bug: v8:8238 Change-Id: I1b24f90f1517fc50360854f46c2d001075544858 Reviewed-on: https://chromium-review.googlesource.com/c/1317817 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/master@{#57263}
-
Igor Sheludko authored
In particular, output root name instead of root value when detecting accesses to roots table. For example: REX.W cmpq [r13+0x80] (root (0x391473a00569 <Map[16]>)),rbx REX.W movq rdi,[r13+0x18] (root (0x391473a007b9 <Map>)) REX.W movq rdi,[r13-0x20] (root (0x391473a005b9 <the_hole>)) turns into REX.W cmpq [r13+0x80] (root (heap_number_map)),rbx REX.W movq rdi,[r13+0x18] (root (fixed_array_map)) REX.W movq rdi,[r13-0x20] (root (the_hole_value)) Bug: v8:8238 Change-Id: I0f7bdcb7774a2fe450f930c1bc2f3ccd03064201 Reviewed-on: https://chromium-review.googlesource.com/c/1317823Reviewed-by:
-
Joyee Cheung authored
Currently to obtain a v8::Array out of a C array or a std::vector, one needs to loop through the elements and call array->Set() multiple times, and these calls go into v8::Object::Set() which can be slow. This patch adds a new Array::New overload that converts a Local<Value>* with known size into a Local<Array>. Change-Id: I0a768f0e18eec51e78d58be455482ec6425ca188 Reviewed-on: https://chromium-review.googlesource.com/c/1317049Reviewed-by:
Yang Guo <yangguo@chromium.org> Reviewed-by:
Adam Klein <adamk@chromium.org> Commit-Queue: Joyee Cheung <joyee@igalia.com> Cr-Commit-Position: refs/heads/master@{#57261}
-
Michael Achenbach authored
TBR=sigurds@chromium.org NOTRY=true Bug: v8:7783 Change-Id: I17f1c17be365db7398e7e13dd62a6dd86a6cb008 Reviewed-on: https://chromium-review.googlesource.com/c/1319569 Commit-Queue: Michael Achenbach <machenbach@chromium.org> Reviewed-by:
-
tzik authored
Unlike other v8::Context getter on v8::Isolate, the v8::Context returned by GetEnteredOrMicrotaskContext may be non-NativeContext. However, Blink implicitly assumes all v8::Context is backed by NativeContexts. This CL updates GetEnteredOrMicrotaskContext() to check the resulting Context is NativeContext, and updates callers of EnterMicrotaskContext to use NativeContext. Change-Id: Ifae528f4ce8feb067f4ad1a43330dc55f4a8ed79 Reviewed-on: https://chromium-review.googlesource.com/c/1301653Reviewed-by:
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/b5b1fdc..47ccdba Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/03ce64d..9a5dbc6 Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/7e0b0c4..459aaba TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org Change-Id: I24add833a4dee7301efa3f1ee2248351e3864074 Reviewed-on: https://chromium-review.googlesource.com/c/1319250Reviewed-by:
v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#57258}
-
Deepti Gandluri authored
This reverts commit de88bfb2. Reason for revert: Breaks msvc build https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Win64%20-%20msvc/5765 Original change's description: > [wasm-simd] Implement remaining I8x16 SIMD ops on x64 > > - Implementation for I8x16 Shifts, and Mul > - Fix convert bug > - Enable all tests except for shuffle tests > > Change-Id: Id1a469d2883c30ea782c51d21dc462d211f94420 > Reviewed-on: https://chromium-review.googlesource.com/c/1318609 > Reviewed-by: Bill Budge <bbudge@chromium.org> > Commit-Queue: Deepti Gandluri <gdeepti@chromium.org> > Cr-Commit-Position: refs/heads/master@{#57254} TBR=bbudge@chromium.org,gdeepti@chromium.org Change-Id: I09efd8002e27f457e89250336e6c3a12d8d9682c No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/1318097Reviewed-by:
Deepti Gandluri <gdeepti@chromium.org> Commit-Queue: Deepti Gandluri <gdeepti@chromium.org> Cr-Commit-Position: refs/heads/master@{#57257}
-
- 05 Nov, 2018 23 commits
-
-
Adam Klein authored
This should allow for better parallelization when running these tests. Change-Id: Ib3cae7d6e8f0d2608470ca616eeac7eecae3b7ab Reviewed-on: https://chromium-review.googlesource.com/c/1318094Reviewed-by:
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/cd2c8fe..b5b1fdc Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/8c035b3..03ce64d TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org Change-Id: I5df515eea0c133826fcc1a78fb2453a2a8043c98 Reviewed-on: https://chromium-review.googlesource.com/c/1318093 Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Reviewed-by:
-
Deepti Gandluri authored
- Implementation for I8x16 Shifts, and Mul - Fix convert bug - Enable all tests except for shuffle tests Change-Id: Id1a469d2883c30ea782c51d21dc462d211f94420 Reviewed-on: https://chromium-review.googlesource.com/c/1318609Reviewed-by:
Bill Budge <bbudge@chromium.org> Commit-Queue: Deepti Gandluri <gdeepti@chromium.org> Cr-Commit-Position: refs/heads/master@{#57254}
-
Sergiy Byelozyorov authored
TBR=machenbach@chromium.org Bug: chromium:899721 Change-Id: Ifdb4864e47a56cb0fe2565e44e79f3def496b138 Reviewed-on: https://chromium-review.googlesource.com/c/1317821 Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org> Reviewed-by:
Sergiy Byelozyorov <sergiyb@chromium.org> Cr-Commit-Position: refs/heads/master@{#57253}
-
Jakob Kummerow authored
and split Smi out of objects.h into smi.h. Bug: v8:3770, v8:5402 Change-Id: I5ff7461495d29c785a76c79aca2616816a29ab1e Reviewed-on: https://chromium-review.googlesource.com/c/1313035Reviewed-by:
Hannes Payer <hpayer@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Reviewed-by:
-
Junliang Yan authored
Change-Id: I273764acb3881a5f682d3cc77e2c8f66bbb7b071 Reviewed-on: https://chromium-review.googlesource.com/c/1318091Reviewed-by:
-
Frank Tang authored
This will give us some clusterfuzz coverage. Bug: v8:7871 Change-Id: I670572454e196b7617a446769216722302f697a9 Reviewed-on: https://chromium-review.googlesource.com/c/1306973Reviewed-by:
Sathya Gunasekaran <gsathya@chromium.org> Commit-Queue: Frank Tang <ftang@chromium.org> Cr-Commit-Position: refs/heads/master@{#57250}
-
Frank Tang authored
Bug: v8:7834 Change-Id: Ib53448757bbaf785ff39ba0da6f54c91e449035b Reviewed-on: https://chromium-review.googlesource.com/c/1314113Reviewed-by:
-
Daniel Clifford authored
CanUseSameAccessor<ElementsAccessor: type> is array-sort.tq is super performance-critical. Reverting the type-safe cleanup made in this function while landing Array.prototype.slice. Bug=chromium:852764 Change-Id: I1252d2ff8e431581f916794807e59abb39248abb Reviewed-on: https://chromium-review.googlesource.com/c/1317815Reviewed-by:
-
Georg Neis authored
The maps in question are already processed in NativeContextData::Serialize. R=jarin@chromium.org Bug: v8:7790 Change-Id: Ifbbff64e10458605b09c74fe09e574b2f2659839 Reviewed-on: https://chromium-review.googlesource.com/c/1317809 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#57247}
-
Toon Verwaest authored
In particular FunctionLiteral body. Now clients cannot use function_literal->body() == nullptr anymore to figure out whether it was preparsed; but have to check the eager compile hint. Change-Id: Ia0d3a6b51c6fb7e803157e98a9d224224e03c8a7 Reviewed-on: https://chromium-review.googlesource.com/c/1317811Reviewed-by:
Camillo Bruni <cbruni@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#57246}
-
Clemens Hammacher authored
Use early returns instead. The general scheme is to return early in the abnormal case (e.g. error) and fall through to the end of the method in the normal case. R=ahaas@chromium.org Bug: v8:8238 Change-Id: I281d35f5aad1f51b6d476fdc685565d9819397bb Reviewed-on: https://chromium-review.googlesource.com/c/1317812 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
-
Toon Verwaest authored
A Property access is only a valid reference expression if the accessed object is a valid expression. Bug: v8:8409 Change-Id: I9bc9ac60ca3bf4e261d10af97aba18e9db2085ea Reviewed-on: https://chromium-review.googlesource.com/c/1317816Reviewed-by:
-
Michael Starzinger authored
R=herhut@chromium.org Change-Id: Ice45defac8f065b6b1c848fd42ead6ab46da89ab Reviewed-on: https://chromium-review.googlesource.com/c/1317573Reviewed-by:
-
Marja Hölttä authored
- Add the WeakRef class and its deref() function. - Add WeakFactory.prototype.makeRef - Implement the "keep during job" behavior for WeakRef constructor and deref(). - Here we keep the targets alive longer than until the end of the job (microtask), contradicting the spec. However, this is probably the indended behavior, see https://github.com/tc39/proposal-weakrefs/issues/39 . BUG=v8:8179 Change-Id: I41990d41ac1799e34f675d8431b9a7aa7ed3d48d Reviewed-on: https://chromium-review.googlesource.com/c/1306435 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#57242}
-
peterwmwong authored
This is resurrecting an optimization from the pre-torque version. Avoid allocating another sequential string for the result when there's only one element, just return the ToString-ed element. This not only saves time writing to this destination string, but also reduce GC pressure. The System Health Memory Benchmark (load:media:google_images) exposed this missing optimization with a 15% regression in memory usage. Very large external strings were being copied into V8's heap as sequential string. Bug: chromium:896612 Change-Id: Ieb61906f64100cdc15bf96f3ebcccb1207f75356 Reviewed-on: https://chromium-review.googlesource.com/c/1316620Reviewed-by:
-
Georg Neis authored
This is a reland of 7bd9eb7e. No changes to that patch other than adding a test case. The bug that lead to the revert has been fixed in 9bf8f72c. Original change's description: > Add fast paths to Array.from. > > This reuses the fast path from IterableToList for Array.from. The fast > paths are taken when .from is called with the receiver Array and the only > argument is the iterable (no mapping function or thisArg). > > Bug: v8:7980 > Change-Id: I975b0c5e3f838262d7b71ad4dec5111fb031d746 > Reviewed-on: https://chromium-review.googlesource.com/c/1297322 > Commit-Queue: Hai Dang <dhai@google.com> > Reviewed-by: Georg Neis <neis@chromium.org> > Cr-Commit-Position: refs/heads/master@{#56993} Bug: v8:7980 Change-Id: Id081837946c0989ec2b31ce991f48d09e0219b09 Reviewed-on: https://chromium-review.googlesource.com/c/1317586Reviewed-by:
-
Michael Starzinger authored
The relocation mode in question was by now only used in tests to model a wrapper call from wrapper code (on the GC'ed heap) to a non-movable wasm code object. Instead of using a special relocation mode, we switch to using the existing {EXTERNAL_REFERENCE} mode similar to other static C++ functions called from generated code. R=sigurds@chromium.org BUG=v8:8238 Change-Id: I30af98b92aed207c52ccccaf018a455ecac39c2b Reviewed-on: https://chromium-review.googlesource.com/c/1309821Reviewed-by: -
Tobias Tebbi authored
This introduces a new syntax for identifiers and calls: modulename::foo. Such a name is resolved by trying to find a module modulename in one of the parent scopes and looking for foo there. So this roughly corresponds to C++ qualified namespace lookup. Bug: v8:7793 Change-Id: Iedc43e6ebe125cd74575cbbcbf990bbcc0155a1f Reviewed-on: https://chromium-review.googlesource.com/c/1309818 Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Reviewed-by:
Daniel Clifford <danno@chromium.org> Cr-Commit-Position: refs/heads/master@{#57238}
-
Clemens Hammacher authored
R=ahaas@chromium.org Bug: v8:8238, v8:7490 Change-Id: I27a57a43ad767d77e64764eda1d9017db87bdfcb Reviewed-on: https://chromium-review.googlesource.com/c/1317588Reviewed-by:
-
Jakob Gruber authored
There's only one allocator kind left post-builtin-snapshot-removal, so the 'Default' prefix can be removed. Bug: v8:6666, v8:7990 Change-Id: Ib3c3eeb121792708591ca7be1e30adef77d3c111 Reviewed-on: https://chromium-review.googlesource.com/c/1309638 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
-
Tobias Tebbi authored
No longer use inheritance to associate Torque-generated assemblers with corresponding CSA subclasses. Instead, all references to CSA and CSA-derived assemblers are now explicitly qualified, by generating a short-lived assembler instance in-place. As a consequence, Torque files have to mention the assembler external macros live in. The CodeStubAssembler is the default for this and can be omitted. As a drive-by cleanup, also distinguish between names that are emitted in C++ and names that are intended to be read in error messages. This is relevant for generic instantiations, where the generated names are rather unreadably mangled. As a follow-up, it will be easy to allow for qualified access to different modules, thus implementing full namespace semantics for modules. Bug: v8:7793 Change-Id: Ie6f1b6b549b510fb49be2442393d898d5f130950 Reviewed-on: https://chromium-review.googlesource.com/c/1309636 Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Reviewed-by:
-
Camillo Bruni authored
Ignore invalid input for all arguments of OptimizeFunctionOnNextCall potentially produced by fuzzers. Bug: chromium:901645 Change-Id: Ic185812c228a92f8dbb48212c45685bd14892947 Reviewed-on: https://chromium-review.googlesource.com/c/1317567Reviewed-by:
-
