- 01 Mar, 2019 1 commit
-
-
Matt Gardner authored
The original was reverted for breaking webkit layout tests: https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8-Blink%20Linux%2064/30270 It also caused the following clusterfuzz failures: chromium:935832 This was a correctness bug due to not properly handling the case of arrays with prototypes other than Array.prototype. Accesses that were TheHole were not being handled property, both in bounds holes in holey arrays and out of bounds on either holey or packed arrays. Handling was incorrect both in access-assembler and in Turbofan. chromium:935932 This bug was that there was no handling for Has checks on the global object. Turbofan was emitting code for a store (the 'else' condition on 'access_mode == AccessMode::kLoad'). It hit a DCHECK in debug builds but in release could show up in different places. This is the bug that caused the webkit layout test failure that led to the revert. Both bugs are fixed by in CL, and tests are added for those cases. Bug: v8:8733, chromium:935932, chromium:935832 Change-Id: Iba0dfcfce6e15d2c0815a7670ece67bc13ba1925 Reviewed-on: https://chromium-review.googlesource.com/c/1493132Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Sigurd Schneider <sigurds@chromium.org> Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Commit-Queue: Matt Gardner <magardn@microsoft.com> Cr-Commit-Position: refs/heads/master@{#59958}
-
- 26 Feb, 2019 1 commit
-
-
Sigurd Schneider authored
This reverts commit 32fc0acf. Reason for revert: https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8-Blink%20Linux%2064/30270 layout test breakage: https://test-results.appspot.com/data/layout_results/V8-Blink_Linux_64/30270/webkit_layout_tests%20%28with%20patch%29/layout-test-results/results.html There is a dead node arriving in representation selection, which might indicate that the problem is not in this CL, but that this CL stirs up the node soup in such a way that dead code elimination gets confused. Original change's description: > Optimize `in` operator > > This change implements optimizations for the `in` operator for packed array > elements and object properties. It adds a new feedback slot kind and an IC > path similar to KeyedLoadIC for handling the lookups. TurboFan uses the > feedback to optimize based on the maps and keys. > > For more details see: > https://docs.google.com/document/d/1tIfzywY8AeNVcy_sen-5Xev21MeZwjcU8QhSdzHvXig > > This can provide 10x performance improvements of on loops of the form: > > for (let i = 0; i < ary.length; ++i) { > if (i in ary) { > ... > } > } > > > Bug: v8:8733 > Change-Id: I766bf865a547a059e5bce5399bb6112e5d9a85c8 > Reviewed-on: https://chromium-review.googlesource.com/c/1432598 > Reviewed-by: Ulan Degenbaev <ulan@chromium.org> > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> > Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Commit-Queue: Matt Gardner <magardn@microsoft.com> > Cr-Commit-Position: refs/heads/master@{#59843} TBR=ulan@chromium.org,rmcilroy@chromium.org,jkummerow@chromium.org,jarin@chromium.org,ishell@chromium.org,bmeurer@chromium.org,verwaest@chromium.org,magardn@microsoft.com Change-Id: Ib2db974e5bed4c4a2b6b450f796bdc4b0b8fd562 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:8733 Reviewed-on: https://chromium-review.googlesource.com/c/1488761Reviewed-by: Sigurd Schneider <sigurds@chromium.org> Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#59857}
-
- 25 Feb, 2019 1 commit
-
-
Matt Gardner authored
This change implements optimizations for the `in` operator for packed array elements and object properties. It adds a new feedback slot kind and an IC path similar to KeyedLoadIC for handling the lookups. TurboFan uses the feedback to optimize based on the maps and keys. For more details see: https://docs.google.com/document/d/1tIfzywY8AeNVcy_sen-5Xev21MeZwjcU8QhSdzHvXig This can provide 10x performance improvements of on loops of the form: for (let i = 0; i < ary.length; ++i) { if (i in ary) { ... } } Bug: v8:8733 Change-Id: I766bf865a547a059e5bce5399bb6112e5d9a85c8 Reviewed-on: https://chromium-review.googlesource.com/c/1432598Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Matt Gardner <magardn@microsoft.com> Cr-Commit-Position: refs/heads/master@{#59843}
-
- 25 Jul, 2017 1 commit
-
-
jgruber authored
The second f1 function would overwrite the first, breaking all tests that were intended to use the first f1 definition. Bug: Change-Id: I79dd1ae344ebf3cf08991d550983f1b01274b352 Reviewed-on: https://chromium-review.googlesource.com/581528Reviewed-by: Yang Guo <yangguo@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#46856}
-
- 30 May, 2017 1 commit
-
-
Camillo Bruni authored
Bug: chromium:726836 Change-Id: I2eaec8550e7ba038646a1f7834d4514a8d4009ea Reviewed-on: https://chromium-review.googlesource.com/517954Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/master@{#45604}
-
- 15 May, 2017 1 commit
-
-
Camillo Bruni authored
With this CL SloppyArguments immediately go to dictionary elements on deletion, keeping the arguments backing store packed. Bug: v8:6251 Change-Id: I90d1972179447bf6810e7fe2b8e0bc8703b38d9d Reviewed-on: https://chromium-review.googlesource.com/486921Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/master@{#45286}
-
- 26 Apr, 2017 1 commit
-
-
cbruni authored
Revert of [turbofan] Set proper representation for initial arguments length. (patchset #1 id:1 of https://codereview.chromium.org/2810333004/ ) Reason for revert: Field representation is not preserved Original issue's description: > [turbofan] Set proper representation for initial arguments length. > > The JSArgumentsObject::length representation is initially Smi, so we can > record that on the initial map and use it to optimize the accesses in > TurboFan based on that. Similar for JSSloppyArgumentsObject::caller. > > BUG=v8:6262 > R=yangguo@chromium.org > > Review-Url: https://codereview.chromium.org/2810333004 > Cr-Commit-Position: refs/heads/master@{#44644} > Committed: https://chromium.googlesource.com/v8/v8/+/5eec7df9b319e5b7a8158d82825d61e90a7cfe33 TBR=yangguo@chromium.org,bmeurer@chromium.org # Not skipping CQ checks because original CL landed more than 1 days ago. BUG=v8:6262 Review-Url: https://codereview.chromium.org/2825323002 Cr-Commit-Position: refs/heads/master@{#44893}
-
- 25 Apr, 2017 2 commits
-
-
Michael Achenbach authored
This reverts commit 28930128. Reason for revert: GC stress failures: https://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/12958 Original change's description: > [runtime] Keep FAST_SLOPPY_ARGUMENTS packed > > With this CL SloppyArguments immediately go to dictionary elements on > deletion, keeping the arguments backing store packed. > > Bug: v8:6251 > Change-Id: I2afa4fb5f0af9942eee0a1606942f5f289539330 > Reviewed-on: https://chromium-review.googlesource.com/480379 > Commit-Queue: Camillo Bruni <cbruni@chromium.org> > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> > Cr-Commit-Position: refs/heads/master@{#44857} TBR=jkummerow@chromium.org,cbruni@chromium.org,v8-reviews@googlegroups.com NOPRESUBMIT=true NOTREECHECKS=true NOTRY=true Change-Id: I9482bf693a745d1301d068869ddae39f11143827 Reviewed-on: https://chromium-review.googlesource.com/486885Reviewed-by: Michael Achenbach <machenbach@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/master@{#44863}
-
Camillo Bruni authored
With this CL SloppyArguments immediately go to dictionary elements on deletion, keeping the arguments backing store packed. Bug: v8:6251 Change-Id: I2afa4fb5f0af9942eee0a1606942f5f289539330 Reviewed-on: https://chromium-review.googlesource.com/480379 Commit-Queue: Camillo Bruni <cbruni@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#44857}
-
- 08 Apr, 2016 1 commit
-
-
cbruni authored
BUG=chromium:601390 LOG=n Review URL: https://codereview.chromium.org/1865343002 Cr-Commit-Position: refs/heads/master@{#35345}
-
- 25 Jun, 2015 1 commit
-
-
verwaest authored
BUG=v8:4137 LOG=n Review URL: https://codereview.chromium.org/1194023004 Cr-Commit-Position: refs/heads/master@{#29287}
-
- 22 Nov, 2013 1 commit
-
-
yangguo@chromium.org authored
The changes are (excluding presubmit.py) mechanical. I added the following lines after the check and iterated the presubmit script until all errors went away: f = open(name, "w"); if contents.endswith('\n\n'): f.write(contents[0:-1]) else: f.write(contents + '\n') R=jkummerow@chromium.org Review URL: https://codereview.chromium.org/82803005 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18017 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 21 Jun, 2011 1 commit
-
-
karlklose@chromium.org authored
TEST=added to test/mjsunit/arguments.js Review URL: http://codereview.chromium.org/7217005 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8348 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 16 Jun, 2011 2 commits
-
-
karlklose@chromium.org authored
Review URL: http://codereview.chromium.org/7187007 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8315 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
karlklose@chromium.org authored
This reverts commit ceb31498b9d69edca3260820fb4047045891ce6d. TBR=kmillikin@chromium.org Review URL: http://codereview.chromium.org/7172030 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8308 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 15 Jun, 2011 2 commits
-
-
karlklose@chromium.org authored
Review URL: http://codereview.chromium.org/7167006 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8300 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
ager@chromium.org authored
R=kasperl@chromium.org BUG= TEST= Review URL: http://codereview.chromium.org/7171016 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8298 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 09 Sep, 2008 1 commit
-
-
christian.plesner.hansen@gmail.com authored
Added presubmit step to check copyright. git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@242 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 22 Aug, 2008 1 commit
-
-
christian.plesner.hansen authored
In the shell sample don't print the result of executing a script, only evaluating expressions. Fixed issue when building samples on Windows using a shared V8 library. Added visibility option on Linux build which makes the generated library 18% smaller. Changed build system to accept multiple build modes in one build and generate seperate objects, libraries and executables for each mode. Removed deferred negation optimization (a * -b => -(a * b)) since this visibly changes operand conversion order. Improved parsing performance by introducing stack guard in preparsing. Without a stack guard preparsing always bails out with stack overflow. git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 03 Jul, 2008 1 commit
-
-
christian.plesner.hansen authored
git-svn-id: http://v8.googlecode.com/svn/trunk@2 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-