- 26 Jun, 2019 19 commits
-
-
Thibaud Michaud authored
R=sigurds@chromium.org Change-Id: Icd6e66b9bb23ca0dbf9fc5fe5c737a0bc3056a89 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1678359 Auto-Submit: Thibaud Michaud <thibaudm@chromium.org> Reviewed-by:
Sigurd Schneider <sigurds@chromium.org> Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#62386}
-
Yang Guo authored
R=verwaest@chromium.org Bug: chromium:878723 Change-Id: Ic07f75f15230018b6d19cd1ee21f4be6dcad6360 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1667408Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Commit-Queue: Yang Guo <yangguo@chromium.org> Cr-Commit-Position: refs/heads/master@{#62385}
-
Junliang Yan authored
Offset adjustment on misaligned loads causes offset to be overflow. This fixes it by using ldx if the new offset overflows. Change-Id: Ib0fd339c127b70d5cbc9096b54480eb4355e753c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1678396 Commit-Queue: Junliang Yan <jyan@ca.ibm.com> Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com> Auto-Submit: Junliang Yan <jyan@ca.ibm.com> Reviewed-by:
Milad Farazmand <miladfar@ca.ibm.com> Cr-Commit-Position: refs/heads/master@{#62384}
-
Thibaud Michaud authored
R=sigurds@chromium.org Change-Id: Id22a44fa15827d5c076496d872fe3be7da360b5e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1678356 Auto-Submit: Thibaud Michaud <thibaudm@chromium.org> Reviewed-by:
-
Mike Stanton authored
We only need to save the native context scope info object to properly brokerize promise call reductions, rather than adding the field to each ContextRef. Bug: v8:7790 Change-Id: Id13dc8505972123cf77a50573c816c9a913686e3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1678416Reviewed-by:
Georg Neis <neis@chromium.org> Commit-Queue: Michael Stanton <mvstanton@chromium.org> Cr-Commit-Position: refs/heads/master@{#62382}
-
Nico Hartmann authored
This is a reland of 5ff38bae Original change's description: > [TurboFan] Fast path for JSAdd with BigInt feedback > > This CL introduces the necessary infrastructure to generate speculative > BigInt operations in case of BigInt feedback. In particular, the JSAdd > operator is lowered to a speculative call to the BigIntAdd builtin, > with a deopt bailout in case of exceptions or violated assumptions. > > Bug: v8:9213 > Change-Id: I05796336eef9a4389fc31d59cad2d69f75512647 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1657916 > Commit-Queue: Nico Hartmann <nicohartmann@google.com> > Reviewed-by: Georg Neis <neis@chromium.org> > Reviewed-by: Sigurd Schneider <sigurds@chromium.org> > Cr-Commit-Position: refs/heads/master@{#62362} Bug: v8:9213 Change-Id: Ic0caf7aab2103b8f5e22a504427e8604cc894d75 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1677209Reviewed-by:
-
Igor Sheludko authored
... instead of [Maybe]ObjectSlot. Bug: v8:9353 Change-Id: I9747da70895e459882a83d06cc20a13b8519e500 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1678196Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#62380}
-
Junliang Yan authored
Bug: v8:9355 Change-Id: I42a683f9480435499e603083e844a47150ae57c8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1676244Reviewed-by:
Alexei Filippov <alph@chromium.org> Commit-Queue: Junliang Yan <jyan@ca.ibm.com> Cr-Commit-Position: refs/heads/master@{#62379}
-
Igor Sheludko authored
When concurrent marking is on then normal stores to tagged fields must be relaxed stores. Bug: v8:9396 Change-Id: Id1189a6c7df5ae8e9e5dc4dad653d35bdd109c5e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1677207Reviewed-by:
-
Leszek Swirski authored
Deprecated maps might not be updated before being passed to PrepareForDataProperty. If the target map is a dictionary map, then adding the data property can fail. As a drive-by, remove the dead ForTransitionHandler code, which was another (potentially unsafe) caller of PrepareForDataProperty Bug: chromium:977012 Change-Id: I894bbc9bca2001555474a3570eb03fe6b0f69ddd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1674029 Auto-Submit: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#62377}
-
Jakob Gruber authored
There's no reason to use the API RegExp type instead of the internal JSRegExp type. In fact, the parsed flags end up in Runtime_CreateRegExpLiteral, which assumes them to be of type JSRegExp::Flags. Drive-by: Additional asserts and helper functions in JSRegExp. Bug: v8:9359 Change-Id: I5c12aba7d4e39a4891fb23d8b47c55fc480a28d9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1667004Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Yang Guo <yangguo@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#62376}
-
Igor Sheludko authored
... for defining isolate-full getters. Bug: v8:9353 Change-Id: I91aa11bfe41ab61b2fa72c21018fc38753a846bd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1676286Reviewed-by:
-
Mathias Bynens authored
It shipped in Chrome 71. Bug: v8:5537 Change-Id: Ia78c58dc0af941ec87c05c933419f7e93d2b26f8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1675951 Commit-Queue: Mathias Bynens <mathias@chromium.org> Auto-Submit: Mathias Bynens <mathias@chromium.org> Reviewed-by:
Sathya Gunasekaran <gsathya@chromium.org> Cr-Commit-Position: refs/heads/master@{#62374}
-
Igor Sheludko authored
... instead of ISOLATELESS_GETTER for declaring and defining getters and predicates that have to deal with decompression of tagged fields. The new macro eases introduction of isolate-full getters. Bug: v8:9353 Change-Id: Ic63baea819a9320c5677f5bd7dda123d7334d80f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1676285 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by:
-
Igor Sheludko authored
... in order to improve quality of C++ assembly. This CL also switches C++ code to use branchful decompression. Bug: v8:9353 Change-Id: Id6a5cc5db2ad729b4394cd541a7ec8035c0d4571 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1677204 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by:
-
Sathya Gunasekaran authored
Change-Id: I8e6f10d6a5cba981134b44fda1a8ae3a4ea0fc97 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1675959 Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org> Reviewed-by:
-
Mike Stanton authored
In TurboFan, context specialization is an optimization that tries to either replace the load of a value from the context with a constant, or if that can't be achieved, at least reduce the hops up the context chain by starting a walk to the required depth from the first constant context that it can reach. Currently, this optimization is performed by looking into the heap during a reducer pass. With fully concurrent TurboFan, we need to instead gather information about contexts we may want to perform this optimization on during serialization. This CL adds functionality to the serializer to recognize and model operations that affect the context register. We add to the hinting structure already used by the serializer. There is a new type of hint: a VirtualContext. This is a tuple consisting of a handle to a Context, and a distance field that indicates how far away in a to-be-realized chain this VirtualContext sits from the context in the handle. For example: bytecode stream: ... CreateBlockContext ... After a block context is created, the accumulator now contains a VirtualContext Hint with a distance of 1 from any context hints that we are keeping track of in the current context register. More details in the design doc here: https://docs.google.com/document/d/1Y0LKKCEenLWyAZTetoAIpKTZRCxaNdkYV8X1GaCax2A/edit?usp=sharing Change-Id: I63732ebd106cc138fb1e9789d0676ece63e15d27 Bug: v8:7790 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1605941 Commit-Queue: Michael Stanton <mvstanton@chromium.org> Reviewed-by:
Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/master@{#62370}
-
Sigurd Schneider authored
This makes sure that BUILDING_V8_SHARED and USING_V8_SHARED are not both set at once. Change-Id: Iba3a4fac37518b6ec3658da4575453a7967ece0f Bug: v8:8855 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627978Reviewed-by:
-
Jakob Gruber authored
Large regexp results may exceed kMaxRegularHeapObjectSize and must thus be allocated in large object space. Drive-by: Rename '%InNewSpace' to '%InYoungGeneration'. Bug: chromium:976627 Change-Id: I38b5aecb95a95cf2fdbb24d19550cec34361a09d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1674027Reviewed-by:
-
- 25 Jun, 2019 21 commits
-
-
Clemens Hammacher authored
We currently only sample synchronous compilation via "V8.WasmCompileModuleMicroSeconds.wasm". This adds a similar counter for asynchronous and streaming compilation. Both use the {AsyncCompileJob}, which now records the start time of compilation and records a sample when baseline compilation finished. The sample will only be taken if a high-resolution clock is available. R=ahaas@chromium.org CC=jwd@chromium.org Bug: chromium:978425 Change-Id: I4b083a8ebba685a1cc8fa87bfe30e9a0943e3394 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1675963Reviewed-by:Andreas Haas <ahaas@chromium.org> Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#62367}
-
Clemens Hammacher authored
Samples for the wire bytes size histogram were only recorded in synchronous and asynchronous (non-streaming) compilation. This CL adds another sample for streaming compilation. R=ahaas@chromium.org Change-Id: I11e2606796a83d6bebb35bd1d554aea43907bfba Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1676284Reviewed-by:
-
Fabrice de Gans-Riberi authored
The call was renamed in Fuchsia, the transitional *_new variant is going to be removed soon. Bug: chromium:977753 Change-Id: I3734cc36a15635dce4dc00d07917879761dec0f5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1676610 Commit-Queue: Fabrice de Gans-Riberi <fdegans@chromium.org> Commit-Queue: Wez <wez@chromium.org> Auto-Submit: Fabrice de Gans-Riberi <fdegans@chromium.org> Reviewed-by:
Wez <wez@chromium.org> Cr-Commit-Position: refs/heads/master@{#62365}
-
Francis McCabe authored
This reverts commit 5ff38bae. Reason for revert: flaky test that is not normally flaky failed. See: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20nosnap%20-%20debug/24531 Original change's description: > [TurboFan] Fast path for JSAdd with BigInt feedback > > This CL introduces the necessary infrastructure to generate speculative > BigInt operations in case of BigInt feedback. In particular, the JSAdd > operator is lowered to a speculative call to the BigIntAdd builtin, > with a deopt bailout in case of exceptions or violated assumptions. > > Bug: v8:9213 > Change-Id: I05796336eef9a4389fc31d59cad2d69f75512647 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1657916 > Commit-Queue: Nico Hartmann <nicohartmann@google.com> > Reviewed-by: Georg Neis <neis@chromium.org> > Reviewed-by: Sigurd Schneider <sigurds@chromium.org> > Cr-Commit-Position: refs/heads/master@{#62362} TBR=jarin@chromium.org,neis@chromium.org,sigurds@chromium.org,nicohartmann@google.com Change-Id: I5ae63a0183283894b6d1130792ab37a95b014550 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:9213 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1676607Reviewed-by:
Francis McCabe <fgm@chromium.org> Commit-Queue: Francis McCabe <fgm@chromium.org> Cr-Commit-Position: refs/heads/master@{#62364}
-
Z Nguyen-Huu authored
Bug: v8:6664 Change-Id: If5a8a85a7537fa429fb58d1e0654ffe5f6a5897f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1669788 Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com> Reviewed-by:
-
Nico Hartmann authored
This CL introduces the necessary infrastructure to generate speculative BigInt operations in case of BigInt feedback. In particular, the JSAdd operator is lowered to a speculative call to the BigIntAdd builtin, with a deopt bailout in case of exceptions or violated assumptions. Bug: v8:9213 Change-Id: I05796336eef9a4389fc31d59cad2d69f75512647 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1657916 Commit-Queue: Nico Hartmann <nicohartmann@google.com> Reviewed-by:
-
Andreas Haas authored
In the context of the reference types proposal, the imaginary sub type of all types was called "bot". With this CL we use this name now also in V8. R=clemensh@chromium.org Bug: v8:9396 Change-Id: I65a2a177ae2af97e66549e7a5b1457595b04a1d8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1675950 Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by:
Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#62361}
-
Georg Neis authored
Change-Id: I386882ba9a95a7eeaa7995423a9d981850680d95 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1675957Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#62360}
-
Michael Achenbach authored
Currently, probabilities for extra flags are calculated in the correctness fuzzer harness, which makes the RNG fragile when bisecting backwards, when the script's config changes during bisection. This adds the possibility to pass extra flags on command line to the script. After a grace period, we will migrate the flag calculation to clusterfuzz. NOTRY=true Bug: chromium:813833 Change-Id: I515181847474515089b847f8aaffc7c6560d9390 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1675945Reviewed-by:
Tamer Tas <tmrts@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/master@{#62359}
-
Sathya Gunasekaran authored
Perform a best-effort check for module context and provide an appropriate error. As seen from the import-blah-script.js test, we could have invalid import expressions in a script context that could result in an error saying "Cannot use import statement outside a module" which isn't the ideal error because the error is an incorrect import expression. But, when the developer changes to a module context, the correct error is thrown. To fix this, we'd have to refactor and call ParseImportDeclaration, and then throw an appropriate error, which seems like a lot of overhead for not enough gain. Bug: v8:9392, v8:6513 Change-Id: I520ebb490fff4d95743a7c751d4095db9a35d41b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1675948Reviewed-by:
Mythri Alle <mythria@chromium.org> Reviewed-by:
-
Seth Brenith authored
This will prevent unnecessary recompilation effort on the subsequent build, and avoids a common issue on Windows where format-torque replaces all of the line endings in a .tq file without changing any actual content. Bug: v8:8805 Change-Id: Id695351c242739d92aef47cd09e651bfbe3c8f9a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1673456Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Reviewed-by:
-
Tamer Tas authored
testrunner assumes that each test suite has a single extension for base tests. ".mjs" extension can be used for ECMAScript modules in addition to the standard extension ".js" we use for the base tests. This CL generalizes the {TestLoader} to accept multiple extensions for a single test suite. R=mathias@chromium.org TBR=machenbach@chromium.org CC=gsathya@chromium.org Bug: v8:9395 Change-Id: Ibc155f4963472fe9f989458cd839f3642ffbddea Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1675961Reviewed-by:Mathias Bynens <mathias@chromium.org> Reviewed-by:
-
Tobias Tebbi authored
Change-Id: Ie5dbbf7cd17571c6ad1b0e83613bce605d0b9257 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1675956Reviewed-by:
Michael Stanton <mvstanton@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#62355}
-
Andreas Haas authored
This CL refactors the type-checking for br_table instructions. Originally, we iterated over all targets of br_table and checked if the values on the stack match the types expected by the target's signature. However, this caused problems with type checking unreachable br_table instructions where some stack values are unavailable. According to the anyref proposal, the expected type of br_table is the greatest lower bound of all its targets. With the existing implementation, the expected types were the types of the first target. With this CL, we first calculate the expected types of br_table, and only then inspect the stack if matching values are available. R=titzer@chromium.org Bug: v8:7581 Change-Id: I12208323bda88c363e28ffb0e002d59ef9a6b9d8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1649791 Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by:
-
Tobias Tebbi authored
This is a reland of 93b6c866 The bug that caused the test failures has been fixed in https://chromium-review.googlesource.com/c/v8/v8/+/1667417 Original change's description: > [csa] add hint to CAST error message to break in mksnapshot > > Change-Id: I51a22de5d6367c38056ea91eface4f69f6651993 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1664069 > Reviewed-by: Ulan Degenbaev <ulan@chromium.org> > Reviewed-by: Michael Stanton <mvstanton@chromium.org> > Commit-Queue: Tobias Tebbi <tebbi@chromium.org> > Cr-Commit-Position: refs/heads/master@{#62274} TBR=mvstanton@chromium.org, ulan@chromium.org Change-Id: I7bb0b4237b6eada82456bc9cf2f293d5986f0d65 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1675954Reviewed-by:
-
Tobias Tebbi authored
In this bug, we might replace a phi node with the Dead node even though it still has uses. DeadCodeElimination picks this up and inserts a runtime crash into the code. Bug: chromium:974474 Change-Id: Iea685913c8666806972719bbfb0891e516207d4f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1669693 Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Reviewed-by:
-
Igor Sheludko authored
This reverts commit 77476cb2. Reason for revert: This is no longer necessary. Let's continue getting test coverage for new elements kinds. Original change's description: > Temporarily disable frozen/sealed elements kinds > > ... to prepare for merging this back to stable chanel. > > Bug: chromium:972921 > Change-Id: I04ced1c81b5f8730014ecee8935799fccc377a49 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1667006 > Commit-Queue: Igor Sheludko <ishell@chromium.org> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Cr-Commit-Position: refs/heads/master@{#62283} TBR=ishell@chromium.org,verwaest@chromium.org # Not skipping CQ checks because original CL landed > 1 day ago. Bug: chromium:972921 Change-Id: I3686bd0f45d354f4826711671a10f1ef7b915e20 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1675953Reviewed-by:
-
Tobias Tebbi authored
This fixes the test SmallOrderedHashMapAllocate in test-code-stub-assembler.cc, which uses memcmp to check SmallOrderedHashMap objects for equality: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20nosnap%20-%20debug/24470 Change-Id: I1c1ad2e8923322c856191fac30f109a4e671b98e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1667417 Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Reviewed-by:
-
Maciej Goszczycki authored
Shared read-only heap means that all isolates within a process must share the same snapshot. Pass the back-end snapshot to the front-end runner to fix that. Bug: v8:7464 Change-Id: I0ec591a919d4d462ef38e372907592df3c759521 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1669691 Commit-Queue: Dan Elphick <delphick@chromium.org> Reviewed-by:
Dan Elphick <delphick@chromium.org> Cr-Commit-Position: refs/heads/master@{#62349}
-
Igor Sheludko authored
... in addition to existing Xxx::yyy(). The idea is to use these getters in hot C++ code since passing isolate explicitly makes it trivial to compute isolate root value and reduces the C++ code size. For full-pointer mode the unused isolate argument will be optimized away by the compiler, so full-pointer mode should not be affected in any sense. Bug: v8:9353 Change-Id: If6c43e3d5b3cbfc0db8b9eccee49dd8c4d168822 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1674035Reviewed-by:
-
Mythri A authored
To correctly fuzz the behaviour of optimized code and ICs we need to allocate feedback vectors. So for the configurations testing these we should turn off lazy feedback allocation. It is also good to fuzz without lazy feedback allocation on other configurations to flush out any other issues. So we also fuzz this with 0.35 chance. We also fuzz aggressive lazy feedback allocation (allocate feedback vectors on first branch / return) with 0.05 chance to test corner cases related to lazy feedback allocation. Bug: v8:9342 Change-Id: Id0761d1396bfc0866988abb8fb20168b86a5da20 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1672939 Commit-Queue: Mythri Alle <mythria@chromium.org> Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/master@{#62347}
-
