- 06 Apr, 2018 3 commits
-
-
Michael Achenbach authored
This reverts commit ad221d14. Reason for revert: Layout test failures: https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/22780 Original change's description: > [wasm] Always enable guard regions on 64-bit platforms > > This change makes full 8 GiB guard regions always enabled on 64-bit > platforms. > > Additionally, since all Wasm memory allocation paths have some form of > guard regions, this removes and simplifies most of the logic around > whether to enable guard regions. > > This is a reland of https://crrev.com/c/985142. > > Bug: v8:7619 > Change-Id: I8bf1f86d6f89fd0bb2144431c7628f15a6b00ba0 > Reviewed-on: https://chromium-review.googlesource.com/996466 > Reviewed-by: Brad Nelson <bradnelson@chromium.org> > Commit-Queue: Eric Holk <eholk@chromium.org> > Cr-Commit-Position: refs/heads/master@{#52412} TBR=bradnelson@chromium.org,eholk@chromium.org Change-Id: Ic15d14c6fa69300bc0fdc036b9fee8ecf65fd397 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:7619 Reviewed-on: https://chromium-review.googlesource.com/999412Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/master@{#52418}
-
Jakob Kummerow authored
Allocating elements and/or property backing stores can, due to retrying, cause a JSObject that has just been allocated in new space to be promoted to old space, so skipping the write barrier is now an invalid optimization. Tbr: hpayer@chromium.org Change-Id: I4a1eacbd59912dd4aa9069b0636f683fb4674231 Reviewed-on: https://chromium-review.googlesource.com/998799Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#52417}
-
Jakob Kummerow authored
There is no good reason to have the meat of most objects' initialization logic in heap.cc, all wrapped by the CALL_HEAP_FUNCTION macro. Instead, this CL changes the protocol between Heap and Factory to be AllocateRaw, and all object initialization work after (possibly retried) successful raw allocation happens in the Factory. This saves about 20KB of binary size on x64. Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng Change-Id: Icbfdc4266d7be8b48d2fe085f03411743dc6a0ca Reviewed-on: https://chromium-review.googlesource.com/959533 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
Hannes Payer <hpayer@chromium.org> Reviewed-by:
Yang Guo <yangguo@chromium.org> Cr-Commit-Position: refs/heads/master@{#52416}
-
- 05 Apr, 2018 37 commits
-
-
Camillo Bruni authored
This is another small step towards detaching the JSFunction from Contexts. In order to not break the debugger protocol we need the inferred name on the ScopeInfo chain. This CL might increase memory usage slightly, given that the inferred name field is duplicated on the ScopeInfo. Bug: v8:7066, chromium:818642 Change-Id: I0dd9f18ae69791f774cf835669afa50491f7433b Reviewed-on: https://chromium-review.googlesource.com/995792 Commit-Queue: Camillo Bruni <cbruni@chromium.org> Reviewed-by:
Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/master@{#52415}
-
Hannes Payer authored
Bug: chromium:814144 Change-Id: Idd729757608a714921254874af98a4a201340870 Reviewed-on: https://chromium-review.googlesource.com/981146Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Hannes Payer <hpayer@chromium.org> Cr-Commit-Position: refs/heads/master@{#52414}
-
Junliang Yan authored
R=joransiu@ca.ibm.com Change-Id: I28c7f3d018a03adb843b0426510c2ba669324b76 Reviewed-on: https://chromium-review.googlesource.com/996593Reviewed-by:
Joran Siu <joransiu@ca.ibm.com> Commit-Queue: Junliang Yan <jyan@ca.ibm.com> Cr-Commit-Position: refs/heads/master@{#52413}
-
Eric Holk authored
This change makes full 8 GiB guard regions always enabled on 64-bit platforms. Additionally, since all Wasm memory allocation paths have some form of guard regions, this removes and simplifies most of the logic around whether to enable guard regions. This is a reland of https://crrev.com/c/985142. Bug: v8:7619 Change-Id: I8bf1f86d6f89fd0bb2144431c7628f15a6b00ba0 Reviewed-on: https://chromium-review.googlesource.com/996466Reviewed-by:
Brad Nelson <bradnelson@chromium.org> Commit-Queue: Eric Holk <eholk@chromium.org> Cr-Commit-Position: refs/heads/master@{#52412}
-
Junliang Yan authored
Port 71018812 Original Commit Message: This is a reland of 7a2c3713 Original change's description: > [debug] introduced runtime side effect check > > This CL demonstrates minimum valuable addition to existing debug evaluate > without side effects mechanism. > With this CL user can evaluate expressions like: > [a,b] // create any kind of temporary array literals > [a,b].reduce((x,y) => x + y, 0); // use reduce method > [1,2,3].fill(2); // change temporary arrays > > The core idea: any change of the object created during evaluation without > side effects is side effect free. As soon as we try to store this temporary > object to object existed before evaluation we will terminate execution. > > Implementation: > - track all objects allocated during evaluation and mark them as temporary, > - patch all bytecodes which change objects. > > A little more details (including performance analysis): [1]. > > [1] https://docs.google.com/document/d/10qqAtZADspPnpYa6SEdYRxrddfKIZJIzbLtGpsZQkRo/edit# > > Bug: v8:7588 > Change-Id: I69f7b96e1ebd7ad0022219e8213211c7be72a111 > Reviewed-on: https://chromium-review.googlesource.com/972615 > Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org> > Reviewed-by: Yang Guo <yangguo@chromium.org> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org> > Cr-Commit-Position: refs/heads/master@{#52370} R=kozyatinskiy@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com BUG= LOG=N Change-Id: I8706efa53d0bbf7d12e48f4f0c4ac387b5faa97b Reviewed-on: https://chromium-review.googlesource.com/998180Reviewed-by:
-
Clemens Hammacher authored
Use 64-bit addition if the pointer size is 8, use 32-bit addition otherwise. R=titzer@chromium.org CC=sreten.kovacevic@mips.com Change-Id: I129cc29454726b7be45ecea13484212cc4f72eea Reviewed-on: https://chromium-review.googlesource.com/998552Reviewed-by:
Ben Titzer <titzer@chromium.org> Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#52410}
-
Eric Holk authored
The bug was fixed in https://crrev.com/c/995796, but this CL adds a regression test to make sure it stays fixed. Bug: chromium:827806 Change-Id: I9f4aed364bbd310af4253da457887a8b8015533a Reviewed-on: https://chromium-review.googlesource.com/993237Reviewed-by:
Clemens Hammacher <clemensh@chromium.org> Commit-Queue: Eric Holk <eholk@chromium.org> Cr-Commit-Position: refs/heads/master@{#52409}
-
Xiaoyin Liu authored
The v8_base project can't be loaded in Visual Studio 2017 because "src/zone/zone-allocator.h" is listed twice. R=jgruber@chromium.org, yangguo@chromium.org Change-Id: Ide2f27a7f8ffd3c57deb7f9ae16c55122d999d06 Reviewed-on: https://chromium-review.googlesource.com/998346Reviewed-by:
-
Fabrice de Gans-Riberi authored
|is_posix| will be switched to false for Fuchsia, this is a preliminary change. Bug: chromium:812974 Change-Id: I2ae8e5ef4270cd0acbc7c69bb46d1be9ed4a5c5e Reviewed-on: https://chromium-review.googlesource.com/988253Reviewed-by:
-
Pierre Langlois authored
The AssembleMove and AssembleSwap tests would only perform moves on stack parameters. This limits us to testing with slots that are likely to be in range of loads and stores. As well as only testing memory accesses with positive offsets relative to the frame pointer. This patch addresses these limitations by moving half of the stack parameters into spill slots, to then perform moves on them. Additionally, to increase ranges, we create articial space between each spilled slot. As a drive-by, allow giving custom names to code objects created with the CodeAssemblerTester. It helps a lot inspecting disassembly. And finally, this CL uncovered a bug where I had forgotten to initialize FixedArrays, which would make the incremental marker crash. Bug: v8:6848 Change-Id: Ic1954c1896130f6c55e09a3068bf341cc4c68670 Reviewed-on: https://chromium-review.googlesource.com/980613 Commit-Queue: Pierre Langlois <pierre.langlois@arm.com> Reviewed-by:
Bill Budge <bbudge@chromium.org> Cr-Commit-Position: refs/heads/master@{#52406}
-
Eric Holk authored
Bug: chromium:828293 Change-Id: I37002c308738eef1366d82a90b7b29d6e44d6c48 Reviewed-on: https://chromium-review.googlesource.com/996585 Commit-Queue: Eric Holk <eholk@chromium.org> Reviewed-by:
-
Marja Hölttä authored
Previous: https://chromium-review.googlesource.com/972962 BUG=v8:7308 Change-Id: I6882e36ad9f9360d006937a2f41b07839a73a768 Reviewed-on: https://chromium-review.googlesource.com/995014Reviewed-by:
Igor Sheludko <ishell@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/master@{#52404}
-
peterwmwong authored
Proposal repo: https://github.com/tc39/proposal-string-matchall - Add new builtins StringPrototypeMatchAll and RegExpPrototypeMatchAll - Add new object RegExpStringIterator Bug: v8:6890 Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng Change-Id: I9fad71900cf30e8632258c309df1c7a638ea4600 Reviewed-on: https://chromium-review.googlesource.com/981893 Commit-Queue: Peter Wong <peter.wm.wong@gmail.com> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#52403}
-
Michael Starzinger authored
R=clemensh@chromium.org Change-Id: I510c8e771ab1c84d094205e247054d8057d2dc85 Reviewed-on: https://chromium-review.googlesource.com/997845Reviewed-by:
-
Camillo Bruni authored
This CL further lowers the kMaxEmptyFactor constant to more aggressively shrink the StringTable when it's empty. Bug: v8:5443, chromium:818642 Change-Id: I1c263a0afd7e6bed8a8bb857db032bf126c3ef4b Reviewed-on: https://chromium-review.googlesource.com/995473Reviewed-by:
-
Yang Guo authored
This is a small step towards making node build on Windows. Bug: v8:6105 R=machenbach@chromium.org Change-Id: I8d3a9b1830bb012d846a791fddc8d1d8d830515e Reviewed-on: https://chromium-review.googlesource.com/980950 Commit-Queue: Yang Guo <yangguo@chromium.org> Reviewed-by:
-
Michael Starzinger authored
R=clemensh@chromium.org Change-Id: Iac827a4fc82f9b810af9d67c4aa5757925edc3c5 Reviewed-on: https://chromium-review.googlesource.com/997742Reviewed-by:
-
Alexey Kozyatinskiy authored
R=yangguo@chromium.org Bug: v8:7588 Change-Id: If78f6dd460c7423923800a98d44520c1bf71663c Reviewed-on: https://chromium-review.googlesource.com/996236 Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org> Reviewed-by:
-
Michael Starzinger authored
R=clemensh@chromium.org Change-Id: Ibe6c203aa3ebdbbd8d3ca1f9f0ddfa7f89d79c71 Reviewed-on: https://chromium-review.googlesource.com/997835 Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by:
-
Clemens Hammacher authored
This adds support for i64.and, i64.or and i64.xor. R=titzer@chromium.org Bug: v8:6600 Change-Id: Ie64e1874f87cd250f3e0641e021f584ecd0aaff9 Reviewed-on: https://chromium-review.googlesource.com/995444Reviewed-by:
-
Clemens Hammacher authored
The amortized cost of a single invocation is actually O(1), not O(n). But this whole comment is needless anyway, so just remove it. R=ahaas@chromium.org NOTRY=true Change-Id: Icffaedcd784584b1676cd7ed323555177a62d63e Reviewed-on: https://chromium-review.googlesource.com/997812Reviewed-by:
Andreas Haas <ahaas@chromium.org> Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#52395}
-
Michael Starzinger authored
R=titzer@chromium.org Change-Id: I2de3bef1753669c7a9f653ece14f168930392180 Reviewed-on: https://chromium-review.googlesource.com/997692Reviewed-by:
-
Peter Marshall authored
Bug: v8:7466 Change-Id: Icb47184e3f6e86bf69157fffd2b29a25ad916500 Reviewed-on: https://chromium-review.googlesource.com/997813Reviewed-by:
Sigurd Schneider <sigurds@chromium.org> Commit-Queue: Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#52393}
-
Igor Sheludko authored
It looks like the normal ways of creating lookup iterators work better. Bug: v8:5988, chromium:828282 Change-Id: Ifd623b2e93708ff8684d056d9292b7779f611a3c Reviewed-on: https://chromium-review.googlesource.com/997474Reviewed-by:
Camillo Bruni <cbruni@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#52392}
-
Andreas Haas authored
Add support for decoding anyref globals, and some drive-by cleanups. R=titzer@chromium.org Bug: v8:7581 Change-Id: I3527f996a3fa1a890918a5924e951fbafa394cf2 Reviewed-on: https://chromium-review.googlesource.com/997655Reviewed-by:
-
Clemens Hammacher authored
This implements f64 comparisons analogue to f32 comparisons (f64.eq, f64.ne, f64.lt, f64.gt, f64.le, f64.ge). R=titzer@chromium.org Bug: v8:6600 Change-Id: I382d575e4f2c585c2de1313f2c2fd2c8cda54a9d Reviewed-on: https://chromium-review.googlesource.com/995773 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
-
Peter Marshall authored
This is a reland of 63ecddc8 Original change's description: > [runtime] Remove the construct_stub field of the SFI > > Don't dispatch based on the construct_stub field anymore. Rather than > read it out and jump to the construct stub, we can switch on the > builtin_id. > > Builtins will always have builtin_id as a Smi, so this signals we need > to jump to JSBuiltinsConstructStub. The only exception is for uncompiled > functions, which will have kCompileLazy as the builtin_id, but need to > jump to the generic stub instead. > > API function calls will have a FunctionTemplateInfo in the SFI > function_data field, and need to go to the builtins stub as well. > > The final case is everything else, which should go to the generic stub. > > Bug: v8:7503 > Change-Id: I14790a5f9784dc0d940bf10a05f5310026e1d482 > Reviewed-on: https://chromium-review.googlesource.com/980941 > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> > Commit-Queue: Peter Marshall <petermarshall@chromium.org> > Cr-Commit-Position: refs/heads/master@{#52345} TBR=bmeurer@chromium.org Bug: v8:7503 Change-Id: Ie46bfb0af173ad7ac8cbdfeed1865e60f3f413f7 Reviewed-on: https://chromium-review.googlesource.com/997712Reviewed-by:
Peter Marshall <petermarshall@chromium.org> Commit-Queue: Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#52389}
-
Peter Marshall authored
Fixes a crash that happens when calling postMessage on an empty typed array. GetBuffer should only call MaterializeArrayBuffer for on-heap buffers, but the on-heap check is slightly wrong. This CL moves the on-heap check logic to the JSTypedArray class so that other parts of the codebase don't need to worry about how that is determined. Also add some dchecks to materialize itself. It should only receive on-heap buffers and should always transform them to off-heap buffers. There is also no reason for it to be static, so change that here too. Bug: chromium:797588 Change-Id: Icd88a5b68e424d82c9f1f7889ca42a40a72a1bdc Reviewed-on: https://chromium-review.googlesource.com/995898 Commit-Queue: Peter Marshall <petermarshall@chromium.org> Reviewed-by:
-
jgruber authored
In order to clarify the difference between, e.g., InstructionStart and instruction_start, rename as follows: Code::instruction_start -> raw_instruction_start Code::instruction_end -> raw_instruction_end Code::instruction_size -> raw_instruction_size The difference between the camel-case and raw_* function families is in how they handle off-heap-trampoline Code objects. For example, when called on an off-heap-trampoline: raw_instruction_start returns the trampoline's entry point, while InstructionStart returns the off-heap code's entry point (located in the .text section of the binary). Some callsites were updated to call the camel-case function family as appropriate. Bug: v8:6666 Change-Id: I4a572f47c2d161a853599d7c17879e263b0d1a87 Reviewed-on: https://chromium-review.googlesource.com/997532 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#52387}
-
Marja Hölttä authored
This pattern seems to reoccur in the code: Handle<TransitionArray> array = TransitionArray::Allocate(...); <something that causes allocation> // Fill up the array array->set(...); If the allocation causes GC, we try to iterate the TransitionArrray in MarkCompactCollector::ClearFullMapTransitions, and that crashes because it expects the TransitionArray to contain handlers (not undefined). This bug is present e.g., in TransitionAccessor::EnsureHasFullTransition. BUG=v8:7308 Change-Id: I306204fc27d62041801427c466c82d1d9df1bf0c Reviewed-on: https://chromium-review.googlesource.com/997493 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by:
-
Michael Achenbach authored
NOTRY=true Bug: chromium:828745 Change-Id: I051f57893937796e01f0b823f1050dd36e0fbfd9 Reviewed-on: https://chromium-review.googlesource.com/997556Reviewed-by:
Sergiy Byelozyorov <sergiyb@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/master@{#52385}
-
Marja Hölttä authored
In addition, remove the default branch from the swtich in HeapObjectPrint, so that it's no longer possible to leave out printing functionality by accident. BUG=v8:7308 Change-Id: I2db67549e328aea6228d3a370f9ebb7494ab3730 Reviewed-on: https://chromium-review.googlesource.com/997492 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by:
-
Predrag Rudic authored
Removing these tests from skip list because corresponding wasm simd opcodes lowering has been implemented. Change-Id: I77bbbee573ba65cf27dc9ee39f4d352bafb5849f Reviewed-on: https://chromium-review.googlesource.com/988032Reviewed-by:
-
Clemens Hammacher authored
This is a reland of 5ae8420c Original change's description: > [Liftoff] Implement float rounding > > This adds support for the four rounding operations on f32 and f64: > f32.ceil, f32.floor, f32.trunc, f32.nearest_int, f64.ceil, f64.floor, > f64.trunc, and f64.nearest_int. > > R=titzer@chromium.org > > Bug: v8:6600 > Change-Id: I16ea91e26c3233af7a33bbb794cd4182f9d7cdb0 > Reviewed-on: https://chromium-review.googlesource.com/995894 > Commit-Queue: Clemens Hammacher <clemensh@chromium.org> > Reviewed-by: Ben Titzer <titzer@chromium.org> > Cr-Commit-Position: refs/heads/master@{#52377} Bug: v8:6600 Change-Id: I9e69309b71041e411bda9ce1375d2451197a111b Reviewed-on: https://chromium-review.googlesource.com/997393 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
-
Predrag Rudic authored
Change-Id: Id661452207cd65445e7390d86f5379b1cc4f1495 Reviewed-on: https://chromium-review.googlesource.com/988012Reviewed-by:
-
Predrag Rudic authored
mjsunit/harmony/bigint/typedarray test failure on mips32 big endian pointed there was a problem. Change-Id: I016a31d7758e7bd4019210e23c147dc0f8ea893f Reviewed-on: https://chromium-review.googlesource.com/995455 Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com> Reviewed-by:
-
Sigurd Schneider authored
This moves ArrayView.isArray and some TypedArray accessors to the JSCallReducer. Bug: v8:7340, v8:7250 Change-Id: Ia6ed9dc5eb8f0c84c286c58d757cbc149d811cf7 Reviewed-on: https://chromium-review.googlesource.com/995454Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#52379}
-
