- 05 Mar, 2018 23 commits
-
-
Ross McIlroy authored
This field is dead since https://chromium-review.googlesource.com/c/v8/v8/+/916261, but got accidentally added back by https://chromium-review.googlesource.com/c/v8/v8/+/919481 due to a bad merge. BUG=v8:5203,chromium:817258 Change-Id: Id6f06de84de7dcd4e6d467edf28974912ad33571 Reviewed-on: https://chromium-review.googlesource.com/948849Reviewed-by:
Mythri Alle <mythria@chromium.org> Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#51738}
-
Michael Starzinger authored
R=ahaas@chromium.org BUG=v8:7509 Change-Id: I928d01e8789ed3d2620f24e439f5a70117b06928 Reviewed-on: https://chromium-review.googlesource.com/947951Reviewed-by:
Andreas Haas <ahaas@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#51737}
-
Sigurd Schneider authored
Math fast-path cannot drop arguments because their side-effects must be preserved. For example, Math.imul(x) dropped x entirely, because if x is convertible to an integer, the result is 0. This, however, is not OK because converting x to an integer might throw. Bug: chromium:818070, v8:7250, v8:7240 Change-Id: I8363e6dcd3fc78c879395aacb636d5782c3b023e Reviewed-on: https://chromium-review.googlesource.com/948523Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#51736}
-
Sigurd Schneider authored
Bug: v8:7517, v8:7310 Change-Id: Ic9a1ac8f4a928e1d5d8f807a0875c7314a7777fb Reviewed-on: https://chromium-review.googlesource.com/946095 Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#51735}
-
Michael Starzinger authored
R=jgruber@chromium.org BUG=v8:7509 Change-Id: If5f7829c4f42e6cb2a8f39d2ddb92a6b024c3506 Reviewed-on: https://chromium-review.googlesource.com/948492Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#51734}
-
Georg Neis authored
This is a cosmetic change only. Change-Id: I9a0ea9a23b4fc1490759433153c7d47e492b853d Reviewed-on: https://chromium-review.googlesource.com/936624 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Reviewed-by:
-
Michael Starzinger authored
R=clemensh@chromium.org BUG=v8:7509 Change-Id: Ia423e60f67d3ffa8d8c2250dc9d4cdff89b91076 Reviewed-on: https://chromium-review.googlesource.com/948487 Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by:
Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#51732}
-
Marja Hölttä authored
Implement in-place weak reference handling in GC. Turn FeedbackVector::optimized_code_or_smi into an in-place weak reference (this is the only in-place weak reference at this point). (See bug for design doc.) BUG=v8:7308 TBR=yangguo@chromium.org Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng Change-Id: I16d65dc768f10ed431252e23a0df07bee9063534 Reviewed-on: https://chromium-review.googlesource.com/948493 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#51731}
-
Michael Starzinger authored
This makes sure that the object can be identified by a unique instance type and hence is not accidentally confused with other FixedArrays on the heap. R=clemensh@chromium.org BUG=v8:7509 Change-Id: I20521cdcabbbddecd89ca8cd4bb203a47e1db0cd Reviewed-on: https://chromium-review.googlesource.com/946253Reviewed-by:
-
Vaclav Brozek authored
ArrayIndexOf is a monolithic builtin which does some checking and then handles three groups of fast arrays: those with holey doubles, compacted doubles and SMIs+objects. TF cannot reuse this efficiently, because calling the TFJ ArrayIndexOf duplicates some checks and also does not allow passing arguments through registers. Similarly for ArrayInclude. This CL splits the three different types of fast array handling into a separate TF stubs, and makes the parent TFJ as well as TurboFan itself use them where appropriate. The TODOs not tackled in this CL inculde: * passing an empty context to spare a register when possible * inlining the search loop if there is any performance gain to it (This is the contiunation of http://crrev.com/2757853002, moved due to Rietveld deprecation.) BUG=v8:5985 Change-Id: I00c97b71be4892f8bc7e1ed6d72e02087618a9a6 Reviewed-on: https://chromium-review.googlesource.com/573020 Commit-Queue: Vaclav Brozek <vabr@chromium.org> Reviewed-by:
Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#51729}
-
Sigurd Schneider authored
OpParameter<int32_t> was still used for an operator after the operators parameter changed from int32_t to a struct. Coincidentally, the first field of the struct holds the value previously stored in that int32_t, so correctness tests did not catch this. Bug: chromium:818611, v8:7517 Change-Id: Ie46f084f7fa8117cd3493fc5ceafac11553dc55e Reviewed-on: https://chromium-review.googlesource.com/948546 Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#51728}
-
jgruber authored
Since we currently only fill the constants table if we're serializing, we should only create & finalize the table in that case. Otherwise, leave it initialized to empty_fixed_array. Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng Bug: v8:6666 Change-Id: I6ecbfac9dc9a9dac7ff0f11331be09b1cbfb4c18 Reviewed-on: https://chromium-review.googlesource.com/948490Reviewed-by:
-
Sigurd Schneider authored
Bug: v8:7517, v8:7310 Change-Id: I438bc933d51062bfbb9a419be9c5b67032707fdb Reviewed-on: https://chromium-review.googlesource.com/946090 Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Reviewed-by:
-
Benedikt Meurer authored
This changes the JSArrayIterator to always have only a single instance type, instead of the zoo of instance types that we had before, and which became less useful with the specification update to when "next" is loaded from the iterator now. This greatly simplifies the baseline implementation of the array iterator, which now only looks at the iterated object during %ArrayIteratorPrototype%.next invocations. In TurboFan we introduce a new JSCreateArrayIterator operator, that holds the IterationKind and get's the iterated object as input. When optimizing %ArrayIteratorPrototype%.next in the JSCallReducer, we check whether the receiver is a JSCreateArrayIterator, and if so, we try to infer maps for the iterated object from there. If we find any, we speculatively assume that these won't have changed during iteration (as we did before with the previous approach), and generate fast code for both JSArray and JSTypedArray iteration. Drive-by-fix: Drop the fast_array_iteration protector, it's not necessary anymore since we have the deoptimization guard bit in the JSCallReducer now. This addresses the performance cliff noticed in webpack 4. The minimal repro on the tracking bug goes from console.timeEnd: mono, 124.773000 console.timeEnd: poly, 670.353000 to console.timeEnd: mono, 118.709000 console.timeEnd: poly, 141.393000 so that's a 4.7x improvement. Also make presubmit happy by adding the missing #undef's. Bug: v8:7510, v7:7514 Change-Id: I79a46bfa2cd0f0710e09365ef72519b1bbb667b5 Reviewed-on: https://chromium-review.googlesource.com/946098Reviewed-by:
-
Clemens Hammacher authored
On ia32, support for vsqrtss and vsqrtsd was missing, so I add the implementation of these instructions and disassembly support. On x64, disassembly support for vsqrtss was missing, while vsqrtsd was implemented. Now both are implemented. The implementation of f32.sqrt and f64.sqrt is very straight-forward on ia32 and x64, we can immediately emit the {v}sqrtss or {v}sqrtsd instruction. R=ahaas@chromium.org Bug: v8:6600 Change-Id: Icf3ec05a97a23e94cdf70f4a72f30dd02fbddd13 Reviewed-on: https://chromium-review.googlesource.com/944221Reviewed-by: -
Sigurd Schneider authored
This reverts commit 07c1e641. Reason for revert: Breaks TSAN build. https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/19784 Original change's description: > [in-place weak refs] Add in-place weak references & migrate one WeakCell to it. > > Implement in-place weak reference handling in GC. > > Turn FeedbackVector::optimized_code_or_smi into an in-place weak reference (this > is the only in-place weak reference at this point). > > (See bug for design doc.) > > BUG=v8:7308 > > Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;master.tryserver.chromium.linux:linux_chromium_rel_ng > Change-Id: I0f9f992cb4ee0457c40b7c868317dfb607bfb906 > Reviewed-on: https://chromium-review.googlesource.com/873638 > Commit-Queue: Marja Hölttä <marja@chromium.org> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org> > Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> > Reviewed-by: Yang Guo <yangguo@chromium.org> > Reviewed-by: Hannes Payer <hpayer@chromium.org> > Cr-Commit-Position: refs/heads/master@{#51722} TBR=ulan@chromium.org,marja@chromium.org,yangguo@chromium.org,hpayer@chromium.org,mlippautz@chromium.org,ishell@chromium.org,bmeurer@chromium.org Change-Id: I75a7dd99fbfd2f5922a6c4d2000bea2adfdeac11 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:7308 Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;master.tryserver.chromium.linux:linux_chromium_rel_ng Reviewed-on: https://chromium-review.googlesource.com/948522Reviewed-by:
-
Marja Hölttä authored
Implement in-place weak reference handling in GC. Turn FeedbackVector::optimized_code_or_smi into an in-place weak reference (this is the only in-place weak reference at this point). (See bug for design doc.) BUG=v8:7308 Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;master.tryserver.chromium.linux:linux_chromium_rel_ng Change-Id: I0f9f992cb4ee0457c40b7c868317dfb607bfb906 Reviewed-on: https://chromium-review.googlesource.com/873638 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
Yang Guo <yangguo@chromium.org> Reviewed-by:
Hannes Payer <hpayer@chromium.org> Cr-Commit-Position: refs/heads/master@{#51722}
-
Georg Neis authored
Only create spread-related feedback slots when the array literal actually contains a spread. Bug: v8:5940 Change-Id: I0afad81d4bf1a86ebc1bf81f1213f680eb22bc49 Reviewed-on: https://chromium-review.googlesource.com/947955 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/master@{#51721}
-
Sigurd Schneider authored
Bug: v8:7495 Change-Id: Id929804e0d0f78c17d81d07cd6a5c5e571449d35 Reviewed-on: https://chromium-review.googlesource.com/947974Reviewed-by:
Michael Stanton <mvstanton@chromium.org> Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#51720}
-
Georg Neis authored
The CHECK didn't account for the recent introduction of StoreInArrayLiteralIC. Bug: v8:5940, chromium:818438 Change-Id: I73b4120eb39b16d766f0b1a9cb82ba44804b09a3 Reviewed-on: https://chromium-review.googlesource.com/947950Reviewed-by:
-
Sigurd Schneider authored
This also introduces FrameStateInfoOf helper. Bug: v8:7517, v8:7310 Change-Id: If2dd1257fb9384fe957a980077a65154cc014d3b Reviewed-on: https://chromium-review.googlesource.com/946009 Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Reviewed-by:
-
jgruber authored
This enables the v8_enable_embedded_builtins gn flag on non-ia32 builds and adds a new --stress-off-heap-code test mode to fyi bots. v8_enable_embedded_builtins=true changes accesses to constants and external references to go through the root list in builtins code. --stress-off-heap-code copies builtins code off-heap on isolate creation. A few drive-by-fixes: - ensure that we actually inspect the correct builtin during isolate-independence testing. - relax tests to decrease maintenance (now we only fail if a builtin should be isolate-independent but isn't). - switch to a different off-heap-trampoline register on arm due to conflicts with custom stub linkages. Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng Bug: v8:6666 Change-Id: I09ad3c75cb4342f4c548ea780f275993730896c8 Reviewed-on: https://chromium-review.googlesource.com/934281 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Michael Hablich <hablich@chromium.org> Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/master@{#51717}
-
Jaroslav Sevcik authored
Change-Id: I618e357ea0d00b64dd4d8a54e865bed716a460e8 Bug: chromium:798964 Reviewed-on: https://chromium-review.googlesource.com/947963Reviewed-by:
-
- 03 Mar, 2018 6 commits
-
-
Mostyn Bramley-Moore authored
Followup to https://chromium-review.googlesource.com/c/v8/v8/+/923718 Bug: v8:6532 Change-Id: I4ed3dd94a59172a54cc5cb70730fdffba4efb383 Reviewed-on: https://chromium-review.googlesource.com/947942Reviewed-by:
Deepti Gandluri <gdeepti@chromium.org> Commit-Queue: Mostyn Bramley-Moore <mostynb@vewd.com> Cr-Commit-Position: refs/heads/master@{#51715}
-
Bill Budge authored
- Removes Reserve, Free (overload) and SetProtection methods. - Updates comment on enum which we still need to distinguish between allocated and reserved ArrayBuffers. Bug: chromium:799573 Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng Change-Id: I1b4e08f97c22ae6b6af847fbcdde047be62fecf8 Reviewed-on: https://chromium-review.googlesource.com/924603Reviewed-by:
Eric Holk <eholk@chromium.org> Commit-Queue: Bill Budge <bbudge@chromium.org> Cr-Commit-Position: refs/heads/master@{#51714}
-
v8-autoroll authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/9ca0348..0fc17e2 Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/414af52..406b235 Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/44042e5..36f3a71 TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org Change-Id: Ibb539a47cdda6165ee6da03df253339be5a87bf5 Reviewed-on: https://chromium-review.googlesource.com/947824 Commit-Queue: v8 autoroll <v8-autoroll@chromium.org> Reviewed-by:
v8 autoroll <v8-autoroll@chromium.org> Cr-Commit-Position: refs/heads/master@{#51713}
-
Jakob Kummerow authored
Per spec, accesses to a DataView object must throw a TypeError if the underlying ArrayBuffer has been detached/neutered. Since that implies a length of 0, we used to detect this as an out-of-bounds access and throw a RangeError. Adding a separate check for buffer detachedness lets us distinguish both cases properly. Bug: v8:4895 Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng Change-Id: I1c1d4145dcd77dfb69f61062e14a6e8e538d45eb Reviewed-on: https://chromium-review.googlesource.com/947585Reviewed-by:
Adam Klein <adamk@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#51712}
-
Jakob Kummerow authored
When the multiplication steps fail, they have already thrown an exception internally, so we should not throw another. The power-of-two fast path erroneously did not throw at all for a few input values. Bug: chromium:818277 Change-Id: If90f6aa3e77fc72e3434daca3b898c77739933ab Reviewed-on: https://chromium-review.googlesource.com/947254 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
-
Jakob Kummerow authored
- Merge new fail expectations that are dupes of existing issues into the respective sections. - Stop skipping tests we can run now. Bug: v8:6791, v8:7511 Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng Change-Id: I4e17ff8eb5d2596561a138e34c441b00b761d7d2 Reviewed-on: https://chromium-review.googlesource.com/947321Reviewed-by:
Sathya Gunasekaran <gsathya@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#51710}
-
- 02 Mar, 2018 11 commits
-
-
Georg Neis authored
... and use it in the implementation of array literal spreads, replacing calls to %AppendElement. Array spreads in destructuring will be taken care of in a separate CL. Bug: v8:5940, v8:7446 Change-Id: Idec52398902a7fd3c1244852cf73246f142404f0 Reviewed-on: https://chromium-review.googlesource.com/915364 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
-
Jakob Kummerow authored
There are some unused bits in a BigInt's bit field. We never read their their values explicitly, but whenever the entire object is moved around (for serialization, or GC), this uninitialized memory is accessed. This patch fixes that by initializing the entire field after allocation of a BigInt, not just the bits we actually use. Bug: chromium:818109 Change-Id: I5a4d24c3240242157b902c696fa9bb779799280d Reviewed-on: https://chromium-review.googlesource.com/946676Reviewed-by:
-
Mathias Bynens authored
This patch removes the ProxyConstructor_ConstructStub builtin, merging its functionality into the refactored ProxyConstructor TurboFan builtin. This brings us closer to our goal of deprecating the `construct_stub` field in `SharedFunctionInfo`. Bug: v8:7503, v8:7518 Change-Id: Iee76ba1a116ba61a543da529ec55149df333dcca Reviewed-on: https://chromium-review.googlesource.com/946488 Commit-Queue: Mathias Bynens <mathias@chromium.org> Reviewed-by:
-
Georg Neis authored
Change-Id: I8f842187d9a02657474c47f5ea1c3257a7ec9317 Reviewed-on: https://chromium-review.googlesource.com/916143Reviewed-by:
-
Sigurd Schneider authored
This is a reland of fdbb5beb Original change's description: > [turbofan] Remove obsolete fast-path > > This is subsumed by an optimization is JSCallReducer now. > > Bug: v8:7340, v8:7250 > Change-Id: I6c706177e410abd57ea24a7ffbbe2437733ed7c7 > Reviewed-on: https://chromium-review.googlesource.com/946088 > Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> > Commit-Queue: Sigurd Schneider <sigurds@chromium.org> > Cr-Commit-Position: refs/heads/master@{#51697} Bug: v8:7340, v8:7250 Change-Id: Ic370c82af78ab8916608f8d774ef1b50d99b894e Reviewed-on: https://chromium-review.googlesource.com/946010Reviewed-by:
-
Clemens Hammacher authored
Unfortunately, different runtime libraries and/or compilers differ on whether a class without any copy constructor, move constructor, copy assignment and move assignment operator is considered trivially copyable. See discussion on https://crrev.com/c/941521. This CL adds a comment about this, and deletes a test for this specific case. R=mstarzinger@chromium.org CC=jyan@ca.ibm.com, ivica.bogosavljevic@mips.com Change-Id: Ie07adda370e5e955b782e72356b50121477d4623 Reviewed-on: https://chromium-review.googlesource.com/944081 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
-
Gabriel Charette authored
This should recover https://chromeperf.appspot.com/report?sid=4d751475ba95911f865aed7a822d55dde18304bc0cfd2f8409d1de9fe9695343 and https://arewefastyet.com/#machine=28&view=single&suite=octane&subtest=Splay It will however regress this: https://chromeperf.appspot.com/report?sid=020744195cfb20c373344b86b76385ce2919b53796b5c0651ba71c0625e8de19&start_rev=531511&end_rev=540262 R=ulan@chromium.org Bug: chromium:812178, chromium:816541 Change-Id: Ia367d24b013c3f16d1dc2ae56d4c5ef23342845f Reviewed-on: https://chromium-review.googlesource.com/946099Reviewed-by:
-
Benedikt Meurer authored
This changes the BytecodeGraphBuilder to connect runtime calls that don't return normally, but always throw exceptions, to End (via a Throw node), instead of inserting Phis on the return values. This unblocks the new optimization approach for array iteration. Bug: v8:7510, v8:7514 Change-Id: Ic78216cc27034f191c4850e476f24e598c17deca Reviewed-on: https://chromium-review.googlesource.com/946250Reviewed-by:
-
Sigurd Schneider authored
Bug: v8:7310 Change-Id: I2e3c324babc4e7e51791c44290dffcf8829c15ce Reviewed-on: https://chromium-review.googlesource.com/946252Reviewed-by:
-
Hannes Payer authored
Bug: chromium:774108 Change-Id: I2765b5d48a53a5ef88ba0503dd47c7188ef2518a Reviewed-on: https://chromium-review.googlesource.com/945789 Commit-Queue: Hannes Payer <hpayer@chromium.org> Reviewed-by:
-
Tobias Tebbi authored
Folding _ + NaN => NaN can widen type None to a constant type, which leads to floating DeadValue nodes. This CL fixes this by removing the optimization. Alternatively, we should consider removing all nodes of type None in simplified lowering. Bug: chromium:817225 Change-Id: I2a126b360d70d3626f8a3c5e73ac72dc980ac8b3 Reviewed-on: https://chromium-review.googlesource.com/946129Reviewed-by:
-
