- 15 Dec, 2017 21 commits
-
-
Bill Budge authored
- Creates a memory management API in v8::internal, which corresponds to the existing one in base::OS. - Implements the new API in terms of the old one. - Changes all usage of the base::OS API to the one in v8::internal. This includes all tests, except platform and OS tests. - Makes OS:: methods private. - Moves all LSAN calls into the v8::internal functions. Bug: chromium:756050 Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng Change-Id: Iaa3f022e3e12fdebf937f3c76b6c6455014beb8a Reviewed-on: https://chromium-review.googlesource.com/794856 Commit-Queue: Bill Budge <bbudge@chromium.org> Reviewed-by:
Eric Holk <eholk@chromium.org> Reviewed-by:
Hannes Payer <hpayer@chromium.org> Cr-Commit-Position: refs/heads/master@{#50139}
-
Caitlin Potter authored
This gets rid of all the RewriteNonPattern gunk in the parser and expression classifier, and removes one use of RewritableExpression. This borrows pieces from several other CLs of mine which are currently open, and includes a new and modernized abstraction for dealing with iterators in BytecodeGenerator (so, this CL adds that, moves code from BuildGetIterator around, and makes some minor changes to yield* which should maintain compatability with the old behaviour). This also implements a portion of the changes to the iteration protocol (implemented fully in https://chromium-review.googlesource.com/c/v8/v8/+/687997), but only for the spread operator in Array Literals (the rest will follow). BUG=v8:5940, v8:3018 R=rmcilroy@chromium.org, marja@chromium.org, adamk@chromium.org TBR=adamk@chromium.org Change-Id: Ifc494d663d8e46066a439c3541c33f0243726234 Reviewed-on: https://chromium-review.googlesource.com/804396 Commit-Queue: Caitlin Potter <caitp@igalia.com> Reviewed-by:
Aleksey Kozyatinskiy <kozyatinskiy@chromium.org> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
Mythri Alle <mythria@chromium.org> Cr-Commit-Position: refs/heads/master@{#50138}
-
Mythri authored
Bytecode jump table for switch statements can have holes when the corresponding case statements do not exist (either because the case was missing or was eliminated because it was dead code). The iterator deals with this by skipping over the holes and setting the iterator to the next valid entry. Bounds check was missing during this skipping over if the last element is a hole. Bug: chromium:794825 Change-Id: Ifdb63257e2997d2fd2868467a56da72b68feb47e Reviewed-on: https://chromium-review.googlesource.com/829774Reviewed-by:
-
Mircea Trofin authored
Bug: chromium:793714 Change-Id: I8c1ea8a2e27b5a7fe9cd1f8260873057a3bf9fd9 Reviewed-on: https://chromium-review.googlesource.com/826030 Commit-Queue: Mircea Trofin <mtrofin@chromium.org> Reviewed-by:
Andreas Haas <ahaas@chromium.org> Reviewed-by:
Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#50136}
-
Bill Budge authored
Bug: chromium:793196 Change-Id: I289653be3968b221bfe4c0f03e8430b2ca76c55c Reviewed-on: https://chromium-review.googlesource.com/827645Reviewed-by:
-
Georgia Kouveli authored
As part of JSSP removal, we need to align the arguments passed to functions on the stack, by adding a padding slot when the total number of arguments is odd. This patch introduces the kPadArguments flag (which is currently set to false for all architectures), which will control padding of arguments in architecture-independent parts of the code (deoptimizer, instruction selector). It also adds some executable tests for tail calls with various stack parameter counts on the caller and callee sides. This will be turned on for arm64 together with arm64-specific changes to the code generator, the MacroAsembler and the builtins, in a later patch. Bug: v8:6644 Change-Id: I79a5c149123fe8130cedd1ccffec3d9b50361e08 Reviewed-on: https://chromium-review.googlesource.com/806554 Commit-Queue: Georgia Kouveli <georgia.kouveli@arm.com> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Reviewed-by:
-
peterwmwong authored
Support inlining Array.prototype.findIndex in Turbofan. Depending on array size, quick benchmarks show a >2x improvement: https://github.com/peterwmwong/v8-perf/blob/master/array-find-findIndex-tf/README.md Bug: chromium:791045, v8:1956, v8:7165 Change-Id: I250554885f924c97b0072e09ee289713df5cbe63 Reviewed-on: https://chromium-review.googlesource.com/824382 Commit-Queue: Peter Wong <peter.wm.wong@gmail.com> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Michael Stanton <mvstanton@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#50133}
-
Ulan Degenbaev authored
The function assumes that the area of a page after the high watermark is not in the free list. This does not hold if allocation observer are active during deserialization. Change-Id: I1f8d0586be6dc535e85d9da5b0fb2791f1de1031 Reviewed-on: https://chromium-review.googlesource.com/829573Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#50132}
-
Mythri authored
Bug: chromium:783124 Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng Change-Id: If2b5d8030d2a8c86c67cb460632a41a11e2c4371 Reviewed-on: https://chromium-review.googlesource.com/828978Reviewed-by:
Yang Guo <yangguo@chromium.org> Reviewed-by:
-
jgruber authored
The unicode property escape syntax restricts unicode property names and unicode property values to consist only of characters taken from the [a-zA-Z0-9_] character class. See the spec at: https://tc39.github.io/proposal-regexp-unicode-property-escapes/ In most cases, we do not actually need to validate that this is the case, since subsequent property lookup in ICU will fail (and throw a SyntaxError) if the given property does not exist. However, there one special case. The ICU lookup takes the property name as a null-terminated string, so it will accept carefully malformed property names (e.g. '\p{Number\0[}'). This can end up confusing the regexp parser. With this CL, we explicitly restrict potential property names / values to the character set as specified. Bug: v8:4743, chromium:793793 Change-Id: Ic97deea8602571ec6793b79c4bb858e1c7597405 Reviewed-on: https://chromium-review.googlesource.com/824272Reviewed-by:
Mathias Bynens <mathias@chromium.org> Reviewed-by:
Sathya Gunasekaran <gsathya@chromium.org> Reviewed-by:
-
Georg Neis authored
In a generator containing loops, there are always certain control flow paths that are impossible, due to the way we represent generators at the bytecode level. Unfortunately, the graph builder can't tell that these paths are impossible. In combination with dead code, it can then happen that we build a subgraph (for unreachable code) whose incoming context is the undefined oddball. JSContextSpecialization did not expect that. Bug: chromium:794822 Change-Id: I259be5ae6c5f5adc8fca19c64bf71285ee922b7a Reviewed-on: https://chromium-review.googlesource.com/828954Reviewed-by:
-
Michael Starzinger authored
This makes sure the builtin lowering of Object.create doesn't invalidate any previously taken dependencies. Aborting compilation after such cases would lead to repeating optimization attempts without learning, hence we disallow such situations. R=verwaest@chromium.org BUG=chromium:794394,chromium:786723 Change-Id: I6b6928cab19692bbbe3cd241ade862a2306eb0c7 Reviewed-on: https://chromium-review.googlesource.com/827066 Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#50128}
-
Michal Majewski authored
Making test262's GetExpectedOutcomes independent from a command. It will enable us to move this function to precompute phase. Bug: v8:6917 Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng Change-Id: Ibb59da29bd30f32427ba6230a22d7d0801954bf0 Reviewed-on: https://chromium-review.googlesource.com/828933Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Commit-Queue: Michał Majewski <majeski@google.com> Cr-Commit-Position: refs/heads/master@{#50127}
-
Igor Sheludko authored
Bug: v8:7206 Change-Id: I4942a4104972cdfe6d3e59be453479888a47d578 Reviewed-on: https://chromium-review.googlesource.com/827062Reviewed-by:
-
Michael Achenbach authored
This reverts commit ce2a9e16. Reason for revert: Breaks all gpu bots, e.g.: https://build.chromium.org/p/client.v8.fyi/builders/Linux%20Release%20%28NVIDIA%29/builds/4628 Original change's description: > [turbofan] Add performance counters for speculation mode change > > Bug: v8:7127, v8:7216 > Change-Id: I57f8bc3f486c53b11475bd174961c4547bb07b04 > Reviewed-on: https://chromium-review.googlesource.com/827073 > Commit-Queue: Sigurd Schneider <sigurds@chromium.org> > Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> > Reviewed-by: Michael Hablich <hablich@chromium.org> > Cr-Commit-Position: refs/heads/master@{#50121} TBR=sigurds@chromium.org,hablich@chromium.org,bmeurer@chromium.org Change-Id: Ic658699a3c267758b925c4a6832992a638125d27 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:7127, v8:7216 Reviewed-on: https://chromium-review.googlesource.com/828874Reviewed-by:
-
Michael Starzinger authored
R=clemensh@chromium.org Change-Id: I6ada57fe5d534ab4ad2549a585d91b204e55a2a6 Reviewed-on: https://chromium-review.googlesource.com/824604 Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by:
-
Michael Achenbach authored
This reverts commit ab38b03d. Reason for revert: https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/20480 https://github.com/v8/v8/wiki/Blink-layout-tests Original change's description: > [builtins] Port Object.p.toLocaleString to CSA from JS > > - Added ObjectPrototypeToLocaleString TFJ > - Remove v8natives.js > - Move GetMethod and GetIterator into prologue.js > > TBR=adamk@chromium.org > > Bug: v8:6005 > Change-Id: I2b5b65892304e62bf64375458f8ffb9473b2c9b7 > Reviewed-on: https://chromium-review.googlesource.com/826479 > Reviewed-by: Peter Wong <peter.wm.wong@gmail.com> > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > Commit-Queue: Peter Wong <peter.wm.wong@gmail.com> > Cr-Commit-Position: refs/heads/master@{#50120} TBR=adamk@chromium.org,peter.wm.wong@gmail.com,jgruber@chromium.org Change-Id: Ib406a55562735cc4d879d62b76f27edf3f1ed211 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:6005 Reviewed-on: https://chromium-review.googlesource.com/828813Reviewed-by:
-
Michal Majewski authored
Bug: v8:6917 Change-Id: Ifc3dac7a82fa67dda1f8b166fbd3f76a123ffba2 Reviewed-on: https://chromium-review.googlesource.com/824365 Commit-Queue: Michał Majewski <majeski@google.com> Reviewed-by:
Sergiy Byelozyorov <sergiyb@chromium.org> Cr-Commit-Position: refs/heads/master@{#50122}
-
Sigurd Schneider authored
Bug: v8:7127, v8:7216 Change-Id: I57f8bc3f486c53b11475bd174961c4547bb07b04 Reviewed-on: https://chromium-review.googlesource.com/827073 Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Reviewed-by:
Michael Hablich <hablich@chromium.org> Cr-Commit-Position: refs/heads/master@{#50121}
-
peterwmwong authored
- Added ObjectPrototypeToLocaleString TFJ - Remove v8natives.js - Move GetMethod and GetIterator into prologue.js TBR=adamk@chromium.org Bug: v8:6005 Change-Id: I2b5b65892304e62bf64375458f8ffb9473b2c9b7 Reviewed-on: https://chromium-review.googlesource.com/826479Reviewed-by:
Peter Wong <peter.wm.wong@gmail.com> Reviewed-by:
-
Jaroslav Sevcik authored
This reverts commit 917b9cb9. In this CL, we canonicalize the fixed array when allocating storage for empty fixed array. During initialization, we also make sure that we do not write to the empty fixed array. This is quite hacky, but it seems to be the least intrusive change. Bug: chromium:793863 Change-Id: I1449ebac7c1e390467566a759bf70e7e2fabda31 Reviewed-on: https://chromium-review.googlesource.com/827013Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#50119}
-
- 14 Dec, 2017 19 commits
-
-
Adam Klein authored
Bug: v8:6822 Change-Id: If6a22e19873b1f3196a4ece48fc79859257ce41d Reviewed-on: https://chromium-review.googlesource.com/804152Reviewed-by:
-
Alexey Kozyatinskiy authored
Async stack trace can contain empty syncrhonous stack and external stack. R=dgozman@chromium.org Bug: chromium:790567 Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel Change-Id: I2b04743f7c4f15a038eb1041cc7fc117d438b6b2 Reviewed-on: https://chromium-review.googlesource.com/822971 Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org> Reviewed-by:
Dmitry Gozman <dgozman@chromium.org> Cr-Commit-Position: refs/heads/master@{#50117}
-
Choongwoo Han authored
Even though IsWasmCompileAllowed function in runtime/runtime-test.cc can be invoked only when native calls are allowed, so this is not an actual bug, fuzzing or random testing can call this function and make a false positive. Thus, add a checking if the given argument is actually an array buffer. Bug: v8:5981 Change-Id: I3918c4d68b67a507c93865effa490d7259d63cb1 Reviewed-on: https://chromium-review.googlesource.com/732383Reviewed-by:
Mircea Trofin <mtrofin@chromium.org> Commit-Queue: Mircea Trofin <mtrofin@chromium.org> Cr-Commit-Position: refs/heads/master@{#50116}
-
Andreas Haas authored
Finishing a chunk of data during streaming compilation caused background tasks to be restarted unconditionally. However, restarting background tasks is not possible after compilation has already finished. With this CL we do not allow anymore to restart background tasks after they have been finished. R=clemensh@chromium.org CC=mtrofin@chromium.org Change-Id: I4c0a9761fb627f04b254f72e05873e29e7647eb0 Reviewed-on: https://chromium-review.googlesource.com/827008 Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by:
-
Igor Sheludko authored
Bug: v8:7206, v8:5561 Change-Id: I3b0e569ac52c889e1b1897cd98bcb7799f308ffb Reviewed-on: https://chromium-review.googlesource.com/819254 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by:
-
Igor Sheludko authored
This CL also adds support for "lookup on dictionary receivers" to store ICs. Bug: v8:7206, v8:5561 Change-Id: Icebbc2d52c71f5d25b43f2f2a8adf674e4ec2cbc Reviewed-on: https://chromium-review.googlesource.com/819232 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by:
-
Sigurd Schneider authored
This CL adds a performace counter similar to https://www.chromestatus.com/metrics/feature/timeline/popularity/2238 to estimate how often speculation is disabled in the wild. Bug: v8:7216, v8:7127 Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng Change-Id: I421637b386534da4a3aed549a9665870e3b97eb1 Reviewed-on: https://chromium-review.googlesource.com/827012Reviewed-by:
-
Michael Achenbach authored
NOTRY=true TBR=ulan@chromium.org Bug: chromium:794911 Change-Id: Ib7be4b44f796153d3972afc878a8ec4911327576 Reviewed-on: https://chromium-review.googlesource.com/827067Reviewed-by:
-
Michael Achenbach authored
This moves the error-code check for verify-predictable mode to the API method checking for status file outcomes, overwriting the default behavior. This is resembling the behavior prior to: https://chromium-review.googlesource.com/c/808971/ Otherwise, the status file outcomes will expect some negative tests to fail in the mozilla test suite, which pass in predictable mode. Now, negative tests are simply not supported. Bug: v8:7166 Change-Id: I1d4bcaf66cb54c5fbb217dd9091b88ecc5b0e456 Reviewed-on: https://chromium-review.googlesource.com/817741Reviewed-by:
-
Igor Sheludko authored
Bug: v8:7206, v8:5561 Change-Id: Ieb8bae0a245c6135d375cec0f76ce80a240391b9 Reviewed-on: https://chromium-review.googlesource.com/819290 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by:
-
Sathya Gunasekaran authored
The IsPromise brand check is now replaced with an IsObject check. The spec was changed here: https://github.com/tc39/proposal-promise-finally/commit/a1628886f85a897df5cd967ea36f025e8f89cb7a Bug: v8:7095 Change-Id: I5668083c888f9efcdfc1491c919c810c75d73ac7 Reviewed-on: https://chromium-review.googlesource.com/826606Reviewed-by:
Georg Neis <neis@chromium.org> Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org> Cr-Commit-Position: refs/heads/master@{#50108}
-
Ulan Degenbaev authored
The following events in v8.gc category are emitted: - V8.GC_BACKGROUND_ARRAY_BUFFER_FREE - V8.GC_BACKGROUND_STORE_BUFFER - V8.GC_BACKGROUND_UNMAPPER - V8.GC_MC_BACKGROUND_EVACUATE_COPY - V8.GC_MC_BACKGROUND_EVACUATE_UPDATE_POINTERS - V8.GC_MC_BACKGROUND_MARKING - V8.GC_MC_BACKGROUND_SWEEPING - V8.GC_MINOR_MC_BACKGROUND_EVACUATE_COPY - V8.GC_MINOR_MC_BACKGROUND_EVACUATE_UPDATE_POINTERS - V8.GC_MINOR_MC_BACKGROUND_MARKING - V8.GC_SCAVENGER_BACKGROUND_SCAVENGE_PARALLEL Bug: chromium:758183 Change-Id: I04368f75ac740cbc832a864609709e5a46f5baef Reviewed-on: https://chromium-review.googlesource.com/825203 Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
-
Michael Achenbach authored
TBR=hablich@chromium.org NOTRY=true Bug: v8:5193 Change-Id: Ia5e91f50e35ca361cdb1eae8c2ca5cc2e2fd866c Reviewed-on: https://chromium-review.googlesource.com/827005Reviewed-by:
-
Michael Starzinger authored
This makes sure that breaking dependencies during compilation is also caught properly in release mode (not only in debug mode). When this happens the generated code would be invalid from the beginning and we need to prevent using such code. R=bmeurer@chromium.org BUG=chromium:794394,chromium:786723 Change-Id: I76fd85786c16807389f69a9c44b9f893004b1c6f Reviewed-on: https://chromium-review.googlesource.com/826635Reviewed-by:
-
Igor Sheludko authored
This CL also removes LoadICProtoArray* builtins which are no longer necessary. Bug: v8:7206, v8:5561 Change-Id: Ic5d9a3d4d21c4bd5e5e1cd110bd029ced157a000 Reviewed-on: https://chromium-review.googlesource.com/819252 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by:
-
Sigurd Schneider authored
Bug: v8:7204, v8:7127 Change-Id: Id99b0e83385275508a9e7f46e17bb8263f7b256a Reviewed-on: https://chromium-review.googlesource.com/826626Reviewed-by:
-
Igor Sheludko authored
Given that we already treat feedback vector as a source of truth for language mode of other store operations and given that the StoreGlobalIC dispatcher does not depend on the language more anymore, we can just combine these two bytecodes. Bug: v8:7206 Change-Id: I27f03f2102ff79ec20fa997eb18dde816f376b00 Reviewed-on: https://chromium-review.googlesource.com/823846Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#50102}
-
Sigurd Schneider authored
Bug: v8:7127, v8:7204 Change-Id: I923658dd9142d658f1155015f5ee02526d280e2a Reviewed-on: https://chromium-review.googlesource.com/824171 Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Reviewed-by:
-
Igor Sheludko authored
... instead of checking if the property cell is still empty when loading/storing through JSGlobalObject prototype. Also invalidate the validity cell when new global lexical variables appear in the script. Bug: v8:5561 Change-Id: Iaf122dffe76d57b32e2b69291dee079e772b271c Reviewed-on: https://chromium-review.googlesource.com/819230Reviewed-by:
-
