1. 29 Sep, 2020 1 commit
  2. 12 May, 2020 1 commit
  3. 06 May, 2020 1 commit
  4. 04 May, 2020 1 commit
  5. 28 Feb, 2020 1 commit
    • Seth Brenith's avatar
      Complete Torque definition of JSArrayBuffer · da900ffe
      Seth Brenith authored
      Previously, our Torque definition of JSArrayBuffer included only the
      first two fields. This allowed access to those two fields, but was
      somewhat confusing and obviously didn't let Torque code access the
      other fields. This change:
      
      - Completes the JSArrayBuffer layout definition;
      - Moves the associated bitfield struct definition to Torque;
      - Moves a couple of JSArrayBuffer macros to Torque;
      - Adds a reducer case so that the code generated using these new macros
        is not worse than what was generated previously.
      
      Change-Id: Ib19c3ba789a33801fa9d0d064cd21d62a1e03e30
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2053769
      Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
      Reviewed-by: 's avatarTobias Tebbi <tebbi@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#66503}
      da900ffe
  6. 18 Dec, 2019 1 commit
    • Nico Hartmann's avatar
      [torque] Enum language feature · fdc9fade
      Nico Hartmann authored
      This CL implements enums in Torque in three steps:
      
      1.) It implements necessary changes to Torque's type system. In
      particular, the constraints on constexpr types are relaxed such that
      constexpr types can exist without a corresponding non-constexpr
      version. Furthermore, constexpr and their non-constexpr counterpart
      need not be of the same kind of type. This allows an AbstractType to
      have a UnionType as its non-constexpr counterpart.
      
      2.) The enum feature itself is realized as a pure desugaring in the
      parser, where all required types, constants and macro specializations
      (like FromConstexpr<>) are generated from a simple enum declaration,
      such that enum entries are not just constants, but are namespace
      scoped and have distinct types so that they can be used within
      typeswitch constructs.
      
      3.) Almost all of the existing constants defined in torque
      (.tq files) are ported to new enum definitions.
      
      Bug: v8:10053
      Change-Id: I72426d3b1434f301fd690847e15603de0dc1021b
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1964392
      Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
      Reviewed-by: 's avatarTobias Tebbi <tebbi@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#65503}
      fdc9fade
  7. 13 Nov, 2019 1 commit
  8. 06 Nov, 2019 1 commit
  9. 04 Nov, 2019 1 commit
  10. 31 Oct, 2019 1 commit
  11. 25 Oct, 2019 1 commit
  12. 23 Oct, 2019 2 commits
  13. 18 Oct, 2019 2 commits
  14. 23 Sep, 2019 1 commit
  15. 19 Sep, 2019 2 commits
    • Igor Sheludko's avatar
      Reland "[ptr-compr] Make on-heap JSTypedArrays smi-corrupting friendly" · dc1a93b8
      Igor Sheludko authored
      This is a reland of 6f9b2bd4
      
      We must load JSTypedArray::base_pointer in TurboFan as tagged value otherwise
      this value may become stale pointer after GC.
      
      Original change's description:
      > [ptr-compr] Make on-heap JSTypedArrays smi-corrupting friendly
      >
      > On-heap typed arrays contain HeapObject value in |base_pointer| field
      > and an offset in |external_pointer| field. When pointer compression is
      > enabled we want to combine decompression with the offset addition.
      > In order to do that we add an isolate root to the external_pointer value
      > and therefore the data pointer computation can is a simple addition of
      > a (potentially sign-extended) |base_pointer| loaded as Tagged_t value
      > and an |external_pointer| value.
      >
      > Bug: v8:9706
      > Change-Id: Id5c546c353c81fb25e3598921bc78165d10a9c44
      > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1807369
      > Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
      > Reviewed-by: Jakob Gruber <jgruber@chromium.org>
      > Reviewed-by: Toon Verwaest <verwaest@chromium.org>
      > Reviewed-by: Georg Neis <neis@chromium.org>
      > Commit-Queue: Igor Sheludko <ishell@chromium.org>
      > Cr-Commit-Position: refs/heads/master@{#63874}
      
      Bug: v8:9706, chromium:1005599
      Cq-Include-Trybots: luci.chromium.try:gpu-fyi-try-win10-nvidia-rel-64
      Change-Id: I7bbd2a439306cdd11f2bb0dab5863498624d9740
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1813744Reviewed-by: 's avatarUlan Degenbaev <ulan@chromium.org>
      Reviewed-by: 's avatarToon Verwaest <verwaest@chromium.org>
      Reviewed-by: 's avatarJakob Gruber <jgruber@chromium.org>
      Reviewed-by: 's avatarGeorg Neis <neis@chromium.org>
      Commit-Queue: Igor Sheludko <ishell@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#63898}
      dc1a93b8
    • Clemens Hammacher's avatar
      Revert "[ptr-compr] Make on-heap JSTypedArrays smi-corrupting friendly" · 815df7d2
      Clemens Hammacher authored
      This reverts commit 6f9b2bd4.
      
      Reason for revert: Fails on nvidia bots, blocking LKGR: https://ci.chromium.org/p/v8/builders/ci/Win%20V8%20FYI%20Release%20(NVIDIA)/5005
      
      Original change's description:
      > [ptr-compr] Make on-heap JSTypedArrays smi-corrupting friendly
      > 
      > On-heap typed arrays contain HeapObject value in |base_pointer| field
      > and an offset in |external_pointer| field. When pointer compression is
      > enabled we want to combine decompression with the offset addition.
      > In order to do that we add an isolate root to the external_pointer value
      > and therefore the data pointer computation can is a simple addition of
      > a (potentially sign-extended) |base_pointer| loaded as Tagged_t value
      > and an |external_pointer| value.
      > 
      > Bug: v8:9706
      > Change-Id: Id5c546c353c81fb25e3598921bc78165d10a9c44
      > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1807369
      > Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
      > Reviewed-by: Jakob Gruber <jgruber@chromium.org>
      > Reviewed-by: Toon Verwaest <verwaest@chromium.org>
      > Reviewed-by: Georg Neis <neis@chromium.org>
      > Commit-Queue: Igor Sheludko <ishell@chromium.org>
      > Cr-Commit-Position: refs/heads/master@{#63874}
      
      TBR=ulan@chromium.org,neis@chromium.org,jgruber@chromium.org,ishell@chromium.org,verwaest@chromium.org
      
      Change-Id: I901280dd191e78d02969600f775c4f0da796921f
      No-Presubmit: true
      No-Tree-Checks: true
      No-Try: true
      Bug: v8:9706
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1813027Reviewed-by: 's avatarClemens Hammacher <clemensh@chromium.org>
      Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#63886}
      815df7d2
  16. 18 Sep, 2019 1 commit
  17. 26 Aug, 2019 1 commit
    • Tobias Tebbi's avatar
      Reland "[torque] introduce JSAny type for user-accessible JavaScript values" · 1ef99b93
      Tobias Tebbi authored
      Changes in the reland: Rebased and added a check that JavaScript-linkage
      builtins use JSAny in parameters and return type, plus the necessary
      cleanups for this test to pass.
      
      Design Doc: https://docs.google.com/document/d/1z6j0pWHnNIfId0v00uWN2HBrGRDJxJfYuCr5K7Kr1xA
      
      This reverts commit 4418a7b9.
      
      Original change's description:
      > Revert "[torque] introduce JSAny type for user-accessible JavaScript values"
      >
      > This reverts commit 79b00555.
      >
      > Reason for revert: needs more discussion
      >
      > Original change's description:
      > > [torque] introduce JSAny type for user-accessible JavaScript values
      > >
      > > This CL introduces a JSAny type for user-exposed JavaScript values and
      > > a few new types to define it. Especially, it splits Symbol into
      > > PrivateSymbol (not exposed) and PublicSymbol (JavaScript exposed
      > > symbols).
      > >
      > > The change is mostly mechanical, but a few things are interesting:
      > > - PropertyKey and JSPrimitive were designed to coincide with the spec
      > >   notions of IsPropertyKey() and primitive value, respectively.
      > > - Since Name is an open type, we define AnyName to be the known
      > >   subtypes of Name. This is not too elegant, but by using AnyName
      > >   instead of Name, typeswitch can properly conclude something if a
      > >   subtype of Name is excluded.
      > >
      > > Small drive-by changes, which were necessary:
      > > - Allow subtyping on label parameters.
      > > - Fix the formatting of typeswitch, it was broken with union types
      > >   in case types.
      > >
      > > Bug: v8:7793
      > > Change-Id: I14b10507f8cf316ad85e048fe8d53d1df5e0bb13
      > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1735322
      > > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
      > > Reviewed-by: Jakob Gruber <jgruber@chromium.org>
      > > Cr-Commit-Position: refs/heads/master@{#63114}
      >
      > TBR=neis@chromium.org,jgruber@chromium.org,tebbi@chromium.org
      >
      > Change-Id: Ifde7881d74afe407628f40047997339d54cb2424
      > No-Presubmit: true
      > No-Tree-Checks: true
      > No-Try: true
      > Bug: v8:7793
      > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1741652
      > Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
      > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
      > Cr-Commit-Position: refs/heads/master@{#63115}
      
      TBR=neis@chromium.org,jgruber@chromium.org,tebbi@chromium.org
      
      # Not skipping CQ checks because original CL landed > 1 day ago.
      
      Bug: v8:7793
      Change-Id: Icca34e3824f55009b984d9348fd21884400f0081
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1769316
      Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
      Reviewed-by: 's avatarTobias Tebbi <tebbi@chromium.org>
      Reviewed-by: 's avatarJakob Gruber <jgruber@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#63395}
      1ef99b93
  18. 07 Aug, 2019 2 commits
    • Tobias Tebbi's avatar
      Revert "[torque] introduce JSAny type for user-accessible JavaScript values" · 4418a7b9
      Tobias Tebbi authored
      This reverts commit 79b00555.
      
      Reason for revert: needs more discussion
      
      Original change's description:
      > [torque] introduce JSAny type for user-accessible JavaScript values
      > 
      > This CL introduces a JSAny type for user-exposed JavaScript values and
      > a few new types to define it. Especially, it splits Symbol into
      > PrivateSymbol (not exposed) and PublicSymbol (JavaScript exposed
      > symbols).
      > 
      > The change is mostly mechanical, but a few things are interesting:
      > - PropertyKey and JSPrimitive were designed to coincide with the spec
      >   notions of IsPropertyKey() and primitive value, respectively.
      > - Since Name is an open type, we define AnyName to be the known
      >   subtypes of Name. This is not too elegant, but by using AnyName
      >   instead of Name, typeswitch can properly conclude something if a
      >   subtype of Name is excluded.
      > 
      > Small drive-by changes, which were necessary:
      > - Allow subtyping on label parameters.
      > - Fix the formatting of typeswitch, it was broken with union types
      >   in case types.
      > 
      > Bug: v8:7793
      > Change-Id: I14b10507f8cf316ad85e048fe8d53d1df5e0bb13
      > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1735322
      > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
      > Reviewed-by: Jakob Gruber <jgruber@chromium.org>
      > Cr-Commit-Position: refs/heads/master@{#63114}
      
      TBR=neis@chromium.org,jgruber@chromium.org,tebbi@chromium.org
      
      Change-Id: Ifde7881d74afe407628f40047997339d54cb2424
      No-Presubmit: true
      No-Tree-Checks: true
      No-Try: true
      Bug: v8:7793
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1741652Reviewed-by: 's avatarTobias Tebbi <tebbi@chromium.org>
      Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#63115}
      4418a7b9
    • Tobias Tebbi's avatar
      [torque] introduce JSAny type for user-accessible JavaScript values · 79b00555
      Tobias Tebbi authored
      This CL introduces a JSAny type for user-exposed JavaScript values and
      a few new types to define it. Especially, it splits Symbol into
      PrivateSymbol (not exposed) and PublicSymbol (JavaScript exposed
      symbols).
      
      The change is mostly mechanical, but a few things are interesting:
      - PropertyKey and JSPrimitive were designed to coincide with the spec
        notions of IsPropertyKey() and primitive value, respectively.
      - Since Name is an open type, we define AnyName to be the known
        subtypes of Name. This is not too elegant, but by using AnyName
        instead of Name, typeswitch can properly conclude something if a
        subtype of Name is excluded.
      
      Small drive-by changes, which were necessary:
      - Allow subtyping on label parameters.
      - Fix the formatting of typeswitch, it was broken with union types
        in case types.
      
      Bug: v8:7793
      Change-Id: I14b10507f8cf316ad85e048fe8d53d1df5e0bb13
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1735322
      Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
      Reviewed-by: 's avatarJakob Gruber <jgruber@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#63114}
      79b00555
  19. 18 Jun, 2019 1 commit
  20. 12 Jun, 2019 1 commit
    • Seth Brenith's avatar
      [torque] Stricter object field verification, part 1 · 3834c637
      Seth Brenith authored
      This change adjusts object initialization order for a few classes so
      that the GC can never see those objects in an invalid, partially-
      initialized state.
      
      AccessorInfo: Just zeros out a few fields upon construction. This is the
      simplest case.
      
      FunctionTemplateInfo: Slightly changes the order in which fields are
      set, so that the Smi field is set ahead of the call to SetCallHandler,
      which can GC. Also a pretty simple case.
      
      JSListFormat, JSPluralRules, JSRelativeTimeFormat, JSSegmenter: The spec
      requires that we start with OrdinaryCreateFromConstructor, which has
      observable side effects (it fetches the prototype from the new.target).
      So we split JSObject::New in half: the first half does all of the user-
      visible things and returns a Map, which we can pass to the second half
      when we're ready to actually allocate the object.
      
      JSTypedArray: Extends the pattern from JSListFormat into Torque code:
      start with a Map and don't allocate the object until we're ready to set
      all of its properties.
      
      Bug: v8:9311
      Change-Id: Id7703e8a0727ec756c774cfbb56af787658a111a
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1646844
      Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
      Reviewed-by: 's avatarJakob Gruber <jgruber@chromium.org>
      Reviewed-by: 's avatarSigurd Schneider <sigurds@chromium.org>
      Reviewed-by: 's avatarUlan Degenbaev <ulan@chromium.org>
      Reviewed-by: 's avatarBenedikt Meurer <bmeurer@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#62123}
      3834c637
  21. 06 Jun, 2019 1 commit
    • Simon Zünd's avatar
      [torque] Add lint errors for unused variable and label bindings · 0e53739c
      Simon Zünd authored
      This CL adds lint errors when 'let' bindings, arguments and labels
      are not used. Note that errors for 'const' bindings will be added
      later.
      
      In cases where arguments are actually needed to match the signature,
      the warning can be silenced by prefixing identifiers with "_". This
      might be needed for generic specializations or builtins called from
      TurboFan. Trying to use a variable or label that was marked with
      "_" results in a compilation error.
      
      Implicit arguments are not linted. They are implemented using exact
      string matching. Prefixing an implicit argument with "_" in a callee
      would break all callers as the names would no longer match.
      
      Drive-by: Fix all new lint errors in the existing Torque code.
      
      Bug: v8:7793
      Change-Id: I68b3c59c76b956e9f88709e9388a40a19546ce52
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1645092
      Commit-Queue: Simon Zünd <szuend@chromium.org>
      Reviewed-by: 's avatarTobias Tebbi <tebbi@chromium.org>
      Reviewed-by: 's avatarSigurd Schneider <sigurds@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#62027}
      0e53739c
  22. 27 May, 2019 3 commits
    • Benedikt Meurer's avatar
      Reland "[typedarray] Move external/data pointer to JSTypedArray." · 70bd7cf0
      Benedikt Meurer authored
      This is a reland of 4b86fea5 with
      copy&paste typo in CodeStubAssembler::AllocateByteArray() fixed
      (bug led to holes in new space, which was crashing reproducibly
      on the ia32 bot).
      
      Original change's description:
      > [typedarray] Move external/data pointer to JSTypedArray.
      >
      > As the next step in supporting huge typed arrays in V8, this moves the
      > external/data pointer from the FixedTypedArrayBase backing store to the
      > JSTypedArray instance itself, and replaces the special backing stores
      > with a plain ByteArray (removing all the code for the FixedTypedArrayBase
      > class hierarchy). By doing so, we can drastically simplify the system
      > around typed arrays.
      >
      > Note: Several places in the code base used to check the instance type
      > of the elements backing store of a JSTypedArray instead of checking the
      > elements kind on the JSTypedArray map directly. Those had to be fixed,
      > since the backing store is now always a ByteArray.
      >
      > Drive-by-fix: Move all the typed elements access related code into the
      > elements.cc file to properly encapsulate the accesses.
      >
      > Doc: http://doc/1Z-wM2qwvAuxH46e9ivtkYvKzzwYZg8ymm0x0wJaomow
      > Bug: chromium:951196, chromium:965583, v8:4153, v8:7881, v8:9183
      > Change-Id: I8cc06b190c53e34155000b4560f5f3ef40621646
      > Cq-Include-Trybots: luci.chromium.try:linux-rel,win7-rel
      > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627535
      > Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
      > Reviewed-by: Peter Marshall <petermarshall@chromium.org>
      > Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
      > Reviewed-by: Simon Zünd <szuend@chromium.org>
      > Cr-Commit-Position: refs/heads/master@{#61855}
      
      Tbr: petermarshall@chromium.org
      Bug: chromium:951196, chromium:965583, v8:4153, v8:7881, v8:9183
      Change-Id: I87fcdb28532c5f08cc227332a4d59546cb423810
      Cq-Include-Trybots: luci.chromium.try:linux-rel, win7-rel
      Cq-Include-Trybots: luci.v8.try:v8_linux_shared_compile_rel
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1631592Reviewed-by: 's avatarBenedikt Meurer <bmeurer@chromium.org>
      Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#61864}
      70bd7cf0
    • Clemens Hammacher's avatar
      Revert "[typedarray] Move external/data pointer to JSTypedArray." · e4db146a
      Clemens Hammacher authored
      This reverts commit 4b86fea5.
      
      Reason for revert: Fails on linux shared: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20shared/31045
      
      Original change's description:
      > [typedarray] Move external/data pointer to JSTypedArray.
      > 
      > As the next step in supporting huge typed arrays in V8, this moves the
      > external/data pointer from the FixedTypedArrayBase backing store to the
      > JSTypedArray instance itself, and replaces the special backing stores
      > with a plain ByteArray (removing all the code for the FixedTypedArrayBase
      > class hierarchy). By doing so, we can drastically simplify the system
      > around typed arrays.
      > 
      > Note: Several places in the code base used to check the instance type
      > of the elements backing store of a JSTypedArray instead of checking the
      > elements kind on the JSTypedArray map directly. Those had to be fixed,
      > since the backing store is now always a ByteArray.
      > 
      > Drive-by-fix: Move all the typed elements access related code into the
      > elements.cc file to properly encapsulate the accesses.
      > 
      > Doc: http://doc/1Z-wM2qwvAuxH46e9ivtkYvKzzwYZg8ymm0x0wJaomow
      > Bug: chromium:951196, chromium:965583, v8:4153, v8:7881, v8:9183
      > Change-Id: I8cc06b190c53e34155000b4560f5f3ef40621646
      > Cq-Include-Trybots: luci.chromium.try:linux-rel,win7-rel
      > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627535
      > Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
      > Reviewed-by: Peter Marshall <petermarshall@chromium.org>
      > Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
      > Reviewed-by: Simon Zünd <szuend@chromium.org>
      > Cr-Commit-Position: refs/heads/master@{#61855}
      
      TBR=ulan@chromium.org,yangguo@chromium.org,titzer@chromium.org,sigurds@chromium.org,petermarshall@chromium.org,bmeurer@chromium.org,szuend@chromium.org
      
      Change-Id: I0bc1f935de6063acf75a0f4bb8c0ba67428603fd
      No-Presubmit: true
      No-Tree-Checks: true
      No-Try: true
      Bug: chromium:951196, chromium:965583, v8:4153, v8:7881, v8:9183
      Cq-Include-Trybots: luci.chromium.try:linux-rel, win7-rel
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1631427Reviewed-by: 's avatarClemens Hammacher <clemensh@chromium.org>
      Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#61856}
      e4db146a
    • Benedikt Meurer's avatar
      [typedarray] Move external/data pointer to JSTypedArray. · 4b86fea5
      Benedikt Meurer authored
      As the next step in supporting huge typed arrays in V8, this moves the
      external/data pointer from the FixedTypedArrayBase backing store to the
      JSTypedArray instance itself, and replaces the special backing stores
      with a plain ByteArray (removing all the code for the FixedTypedArrayBase
      class hierarchy). By doing so, we can drastically simplify the system
      around typed arrays.
      
      Note: Several places in the code base used to check the instance type
      of the elements backing store of a JSTypedArray instead of checking the
      elements kind on the JSTypedArray map directly. Those had to be fixed,
      since the backing store is now always a ByteArray.
      
      Drive-by-fix: Move all the typed elements access related code into the
      elements.cc file to properly encapsulate the accesses.
      
      Doc: http://doc/1Z-wM2qwvAuxH46e9ivtkYvKzzwYZg8ymm0x0wJaomow
      Bug: chromium:951196, chromium:965583, v8:4153, v8:7881, v8:9183
      Change-Id: I8cc06b190c53e34155000b4560f5f3ef40621646
      Cq-Include-Trybots: luci.chromium.try:linux-rel,win7-rel
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627535
      Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
      Reviewed-by: 's avatarPeter Marshall <petermarshall@chromium.org>
      Reviewed-by: 's avatarUlan Degenbaev <ulan@chromium.org>
      Reviewed-by: 's avatarSimon Zünd <szuend@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#61855}
      4b86fea5
  23. 20 May, 2019 1 commit
  24. 14 May, 2019 1 commit
  25. 07 May, 2019 1 commit
    • Peter Marshall's avatar
      Reland "[typedarray] Make JSTypedArray::length authoritative." · 330e5ba2
      Peter Marshall authored
      This is a reland of ad44c258
      
      Patchset 2 is the original CL
      Patchset 3 fixes some misuses of FixedArrayBase::length() and adds some
      DCHECKS to flush out any more misuses.
      Patchset 4 adds the PPC/S390 port by miladfar@ca.ibm.com.
      
      Original change's description:
      > [typedarray] Make JSTypedArray::length authoritative.
      >
      > This is the first step towards full huge typed array support in V8.
      > Before this change, the JSTypedArray::length and the elements backing
      > store length (FixedTypedArrayBase::length) were used more or less
      > interchangeably to determine the number of elements in a JSTypedArray.
      >
      > With this change we disentangle these two lengths, and instead make
      > JSTypedArray::length authoritative. For on-heap typed arrays, the
      > FixedTypedArrayBase::length will remain the number of elements in the
      > backing store, but for the off-heap typed arrays, this length will be
      > set to 0 (matching the fact that the FixedTypedArrayBase instance does
      > not contain any elements itself).
      >
      > This also unifies the JSTypedArray::set_/length() and length_value()
      > methods to only have JSTypedArray::set_/length() which returns/takes
      > size_t values. Currently this still requires the values to be in Smi
      > range, but later we will extend this to allow arbitrary size_t values
      > (in the safe integer range).
      >
      > Bug: v8:4153, v8:7881
      > Change-Id: Iff9089130bb31fa9e08e0cf913e7ab52c3dbf107
      > Cq-Include-Trybots: luci.chromium.try:linux-blink-rel
      > Doc: http://doc/1Z-wM2qwvAuxH46e9ivtkYvKzzwYZg8ymm0x0wJaomow
      > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1543729
      > Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
      > Reviewed-by: Peter Marshall <petermarshall@chromium.org>
      > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
      > Reviewed-by: Ben Titzer <titzer@chromium.org>
      > Reviewed-by: Hannes Payer <hpayer@chromium.org>
      > Cr-Commit-Position: refs/heads/master@{#60648}
      
      Bug: v8:4153, v8:7881, v8:9105
      Change-Id: Ic38f833071a723642ebc6f82a4012dbc0878ef98
      Cq-Include-Trybots: luci.chromium.try:linux-blink-rel
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1594435Reviewed-by: 's avatarBenedikt Meurer <bmeurer@chromium.org>
      Reviewed-by: 's avatarHannes Payer <hpayer@chromium.org>
      Commit-Queue: Peter Marshall <petermarshall@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#61275}
      330e5ba2
  26. 02 May, 2019 1 commit
    • Peter Marshall's avatar
      Revert "[typedarray] Make JSTypedArray::length authoritative." · 18100666
      Peter Marshall authored
      This reverts commit ad44c258.
      
      Reason for revert: Missed some users: crbug.com/v8/9105
      
      Original change's description:
      > [typedarray] Make JSTypedArray::length authoritative.
      >
      > This is the first step towards full huge typed array support in V8.
      > Before this change, the JSTypedArray::length and the elements backing
      > store length (FixedTypedArrayBase::length) were used more or less
      > interchangeably to determine the number of elements in a JSTypedArray.
      >
      > With this change we disentangle these two lengths, and instead make
      > JSTypedArray::length authoritative. For on-heap typed arrays, the
      > FixedTypedArrayBase::length will remain the number of elements in the
      > backing store, but for the off-heap typed arrays, this length will be
      > set to 0 (matching the fact that the FixedTypedArrayBase instance does
      > not contain any elements itself).
      >
      > This also unifies the JSTypedArray::set_/length() and length_value()
      > methods to only have JSTypedArray::set_/length() which returns/takes
      > size_t values. Currently this still requires the values to be in Smi
      > range, but later we will extend this to allow arbitrary size_t values
      > (in the safe integer range).
      >
      > Bug: v8:4153, v8:7881
      > Change-Id: Iff9089130bb31fa9e08e0cf913e7ab52c3dbf107
      > Cq-Include-Trybots: luci.chromium.try:linux-blink-rel
      > Doc: http://doc/1Z-wM2qwvAuxH46e9ivtkYvKzzwYZg8ymm0x0wJaomow
      > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1543729
      > Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
      > Reviewed-by: Peter Marshall <petermarshall@chromium.org>
      > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
      > Reviewed-by: Ben Titzer <titzer@chromium.org>
      > Reviewed-by: Hannes Payer <hpayer@chromium.org>
      > Cr-Commit-Position: refs/heads/master@{#60648}
      
      TBR=jarin@chromium.org,titzer@chromium.org,hpayer@chromium.org,petermarshall@chromium.org,bmeurer@chromium.org
      
      # Not skipping CQ checks because original CL landed > 1 day ago.
      
      TBR=jarin@chromium.org, szuend@chromium.org
      
      Bug: v8:4153, v8:7881
      Change-Id: I96992bff15b4a2765ae4a557d2c37e78269c927d
      Cq-Include-Trybots: luci.chromium.try:linux-blink-rel
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1593294
      Commit-Queue: Peter Marshall <petermarshall@chromium.org>
      Reviewed-by: 's avatarJaroslav Sevcik <jarin@chromium.org>
      Reviewed-by: 's avatarPeter Marshall <petermarshall@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#61172}
      18100666
  27. 11 Apr, 2019 1 commit
  28. 05 Apr, 2019 1 commit
    • Benedikt Meurer's avatar
      [typedarray] Make JSTypedArray::length authoritative. · ad44c258
      Benedikt Meurer authored
      This is the first step towards full huge typed array support in V8.
      Before this change, the JSTypedArray::length and the elements backing
      store length (FixedTypedArrayBase::length) were used more or less
      interchangeably to determine the number of elements in a JSTypedArray.
      
      With this change we disentangle these two lengths, and instead make
      JSTypedArray::length authoritative. For on-heap typed arrays, the
      FixedTypedArrayBase::length will remain the number of elements in the
      backing store, but for the off-heap typed arrays, this length will be
      set to 0 (matching the fact that the FixedTypedArrayBase instance does
      not contain any elements itself).
      
      This also unifies the JSTypedArray::set_/length() and length_value()
      methods to only have JSTypedArray::set_/length() which returns/takes
      size_t values. Currently this still requires the values to be in Smi
      range, but later we will extend this to allow arbitrary size_t values
      (in the safe integer range).
      
      Bug: v8:4153, v8:7881
      Change-Id: Iff9089130bb31fa9e08e0cf913e7ab52c3dbf107
      Cq-Include-Trybots: luci.chromium.try:linux-blink-rel
      Doc: http://doc/1Z-wM2qwvAuxH46e9ivtkYvKzzwYZg8ymm0x0wJaomow
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1543729
      Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
      Reviewed-by: 's avatarPeter Marshall <petermarshall@chromium.org>
      Reviewed-by: 's avatarJaroslav Sevcik <jarin@chromium.org>
      Reviewed-by: 's avatarBen Titzer <titzer@chromium.org>
      Reviewed-by: 's avatarHannes Payer <hpayer@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#60648}
      ad44c258
  29. 04 Mar, 2019 1 commit
  30. 27 Feb, 2019 4 commits
  31. 24 Feb, 2019 1 commit