- 12 Jun, 2019 1 commit
-
-
Z Nguyen-Huu authored
Extend same approach for FastJSArray to FastJSArrayForRead in ArrayMap builtin ~6x perf improvement in micro-benchmark JSTests/ObjectFreeze Before: ArrayMap ArrayMap-Numbers(Score): 0.0887 After: ArrayMap ArrayMap-Numbers(Score): 0.531 Bug: v8:6831 Change-Id: I06cba44ca4c9198977c6da522b782b61f9df04fa Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1653732 Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Simon Zünd <szuend@chromium.org> Cr-Commit-Position: refs/heads/master@{#62127}
-
- 27 May, 2019 1 commit
-
-
Z Nguyen-Huu authored
Improve micro-benchmark by ~5x Before: ApplySpreadLiteral ApplySpreadLiteral-Numbers(Score): 279 SpreadCallSpreadLiteral SpreadCallSpreadLiteral-Numbers(Score): 285 After: ApplySpreadLiteral ApplySpreadLiteral-Numbers(Score): 1074 SpreadCallSpreadLiteral SpreadCallSpreadLiteral-Numbers(Score): 1009 Bug: v8:6831 Change-Id: Ifd676ca13d5b7e86afc1578636fdd4dc2733c474 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1628244 Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#61862}
-
- 20 May, 2019 1 commit
-
-
Z Duong Nguyen-Huu authored
Also add mjsunit test for spread call with non-extensible objects Micro-benchmark JSTests/ObjectFreeze shows ~7x improvement Before: SpreadCall SpreadCall-Numbers(Score): 239 After: SpreadCall SpreadCall-Numbers(Score): 1461 Bug: v8:6831 Change-Id: Icefd89ad790ac159b7f0617d0a012eefd90d3b1d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1614296Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com> Cr-Commit-Position: refs/heads/master@{#61669}
-
- 07 May, 2019 1 commit
-
-
Z Duong Nguyen-Huu authored
This is the follow-up for frozen, sealed packed elements kind. Design docs: bit.ly/fast-frozen-sealed-elements-in-v8 This change is only support the transition from holey elements to holey sealed elements (via object.seal) or to holey frozen elements (via object.freeze). Added tests for non-extensible, sealed, frozen holey elements in https://chromium-review.googlesource.com/c/v8/v8/+/1574503 and https://chromium-review.googlesource.com/c/v8/v8/+/1582481 Bug: v8:6831 Change-Id: Ia4373648f79f2ebebb390982a503145844a0c123 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1574777 Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#61307}
-
- 24 Apr, 2019 1 commit
-
-
Z Duong Nguyen-Huu authored
Bug: v8:6831 Change-Id: I4d4d9b65a346384b8f6c6dc2cfe0c1ce88116e18 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1574503 Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#60993}
-
- 23 Apr, 2019 1 commit
-
-
Z Duong Nguyen-Huu authored
Bug: chromium:953888 Change-Id: If2aa613bac18e61ac733102b45b0ebb6553eae1a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1579539Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com> Cr-Commit-Position: refs/heads/master@{#60959}
-
- 16 Apr, 2019 2 commits
-
-
Z Duong Nguyen-Huu authored
Increase length of packed sealed array will create holes in packed array so transition to dictionary elements for now. Later we can consider transitioning to holey sealed array. Bug: chromium:952382 Change-Id: Ibe26ce56918859a114fccc1933f9c966c47c4112 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1566968 Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#60884}
-
Z Duong Nguyen-Huu authored
Just update merge conflict. The reverted CL is https://chromium-review.googlesource.com/c/v8/v8/+/1565470. Treat packed sealed, frozen element as packed element. Also rename to IsPackedFrozenOrSealedElementsKind. Bug: chromium:951988 Change-Id: I4e7cc0a0d43e1e1c109fa08231dd5396901f9614 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1566235 Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#60881}
-
- 12 Apr, 2019 4 commits
-
-
Z Duong Nguyen-Huu authored
Basically, SetPropertyInternal is called without handling COW map. Improve test coverage as well. Bug: chromium:951438 Change-Id: Iea8c818ab6a8ddea204f86a9d676a1ea42fd07f0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1562731 Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#60834}
-
Sathya Gunasekaran authored
This reverts commit 68ba8574. Reason for revert: breaks windows builds https://ci.chromium.org/p/v8/builders/ci/V8%20Win32%20-%20builder/27839 Original change's description: > Fix array.concat with double for sealed, frozen object > > Treat packed sealed, frozen element as packed element. > Also rename to IsPackedFrozenOrSealedElementsKind. > > Bug: chromium:951988 > Change-Id: Ia636f0a14a229e4c44772627728927db1b877f27 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1565470 > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com> > Cr-Commit-Position: refs/heads/master@{#60831} TBR=jarin@chromium.org,ishell@chromium.org,verwaest@chromium.org,duongn@microsoft.com Change-Id: I84caf106dbdd2209aef0a994173e1c3982e9f7b1 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: chromium:951988 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1565542Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org> Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org> Cr-Commit-Position: refs/heads/master@{#60832}
-
Z Duong Nguyen-Huu authored
Treat packed sealed, frozen element as packed element. Also rename to IsPackedFrozenOrSealedElementsKind. Bug: chromium:951988 Change-Id: Ia636f0a14a229e4c44772627728927db1b877f27 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1565470Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com> Cr-Commit-Position: refs/heads/master@{#60831}
-
Z Duong Nguyen-Huu authored
For slow-path of array.includes, it should be able to handle if arguments is undefined for sealed/frozen object Bug: chromium:951780 Change-Id: I42dcf1e23ab07bfcd87e7a5d27b52e66b2d1d2ae Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1565031Reviewed-by: Simon Zünd <szuend@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com> Cr-Commit-Position: refs/heads/master@{#60829}
-
- 11 Apr, 2019 2 commits
-
-
Z Duong Nguyen-Huu authored
The last step in array.splice slow-path is to update length of the array https://cs.chromium.org/chromium/src/v8/src/builtins/array-splice.tq?rcl=59a29d88cc5972d2323a80a70de19ffd2812e5e4&l=349. For sealed object, it should be nop. Bug: chromium:951164 Change-Id: I0c3098526c7df6c4dd734dd6c79cc0bba3b9b213 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1559217 Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#60793}
-
Z Duong Nguyen-Huu authored
It should work when Object.defineProperty is used to set a new value for seal object. Add more test to cover this case as well. Bug: chromium:951374 Change-Id: Idbbcc052b627587c71d5b5252340130d0fdfd595 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1562470Reviewed-by: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com> Cr-Commit-Position: refs/heads/master@{#60786}
-
- 05 Apr, 2019 1 commit
-
-
Anna Henningsen authored
Typed arrays with elements cannot be frozen, but this function previously would have falsely reported that they are after an `Object.freeze()` call. Since the latter bails out when the object is already frozen, the effect was that when calling `Object.freeze()` on a typed array more than once, the first call would throw and subsequent ones would not. Change-Id: I75e59f51ebb94797cdf39bac4ec4c25c547e70a3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1552781 Commit-Queue: Peter Marshall <petermarshall@chromium.org> Reviewed-by: Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#60652}
-
- 25 Feb, 2019 1 commit
-
-
Z Duong Nguyen-Huu authored
Bug: v8:6831 Change-Id: I6e9f6fc718928f2f86d3b3c2dd144a6636b05790 Reviewed-on: https://chromium-review.googlesource.com/c/1481895 Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Simon Zünd <szuend@chromium.org> Cr-Commit-Position: refs/heads/master@{#59844}
-
- 22 Apr, 2015 2 commits
-
-
machenbach authored
Revert of Revert of [es6] don't throw if argument is non-object (O.freeze, O.seal, O.preventExtensions) (patchset #1 id:1 of https://codereview.chromium.org/1103473003/) Reason for revert: This was probably an infrastructure problem caused by the mac ninja/goma switch. Original issue's description: > Revert of [es6] don't throw if argument is non-object (O.freeze, O.seal, O.preventExtensions) (patchset #7 id:140001 of https://codereview.chromium.org/1011823003/) > > Reason for revert: > [Sheriff] breaks mac gc stress: > http://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/1029 > > Original issue's description: > > [es6] don't throw if argument is non-object (O.freeze, O.seal, O.preventExtensions) > > > > BUG=v8:3965, v8:3966 > > R=arv@chromium.org > > LOG=N > > > > Committed: https://crrev.com/b09c048f693d280052ac63c7d6b3baf27b3bf271 > > Cr-Commit-Position: refs/heads/master@{#27985} > > TBR=arv@chromium.org,caitpotter88@gmail.com > NOPRESUBMIT=true > NOTREECHECKS=true > NOTRY=true > BUG=v8:3965, v8:3966 TBR=arv@chromium.org,caitpotter88@gmail.com NOPRESUBMIT=true NOTREECHECKS=true NOTRY=true BUG=v8:3965, v8:3966 Review URL: https://codereview.chromium.org/1098243002 Cr-Commit-Position: refs/heads/master@{#27999}
-
machenbach authored
Revert of [es6] don't throw if argument is non-object (O.freeze, O.seal, O.preventExtensions) (patchset #7 id:140001 of https://codereview.chromium.org/1011823003/) Reason for revert: [Sheriff] breaks mac gc stress: http://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/1029 Original issue's description: > [es6] don't throw if argument is non-object (O.freeze, O.seal, O.preventExtensions) > > BUG=v8:3965, v8:3966 > R=arv@chromium.org > LOG=N > > Committed: https://crrev.com/b09c048f693d280052ac63c7d6b3baf27b3bf271 > Cr-Commit-Position: refs/heads/master@{#27985} TBR=arv@chromium.org,caitpotter88@gmail.com NOPRESUBMIT=true NOTREECHECKS=true NOTRY=true BUG=v8:3965, v8:3966 Review URL: https://codereview.chromium.org/1103473003 Cr-Commit-Position: refs/heads/master@{#27990}
-
- 21 Apr, 2015 1 commit
-
-
caitpotter88 authored
BUG=v8:3965, v8:3966 R=arv@chromium.org LOG=N Review URL: https://codereview.chromium.org/1011823003 Cr-Commit-Position: refs/heads/master@{#27985}
-
- 10 Dec, 2014 1 commit
-
-
adamk authored
They both now run fast (due to utilizing transitions instead of always creating new maps) and sealed or non-extensible objects can stay in fast mode after transitioning. This almost entirely reuses the code for transitioning objects frozen by Object.freeze(), with the added benefit of freeing up a bit on the map (we no longer keep track of frozen-ness, as that bit wasn't used for anything interesting). BUG=v8:3662,chromium:115960 LOG=y Review URL: https://codereview.chromium.org/776143005 Cr-Commit-Position: refs/heads/master@{#25759}
-
- 11 Nov, 2014 1 commit
-
-
jkummerow@chromium.org authored
This relands commit ea74f0f8. The revert was due to failures in cctest/test-heap/ReleaseOverReservedPages, caused by apparent changes to memory layout and fragmentation of the first page. Eliminating a situation in messages.js where this CL has had an effect on map transitions seems to solve the issue. R=verwaest@chromium.org Review URL: https://codereview.chromium.org/714883003 Cr-Commit-Position: refs/heads/master@{#25266} git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25266 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 07 Nov, 2014 2 commits
-
-
arv@chromium.org authored
This reverts commit e1f23eab4255d63344011dfb885b8e8962cb60e2. Broke cctest/test-heap/ReleaseOverReservedPages on a bunch of builders http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20debug/builds/928/steps/Check/logs/ReleaseOverReservedPa.. BUG=None LOG=N TBR=jkummerow@chromium.org Review URL: https://codereview.chromium.org/709123002 Cr-Commit-Position: refs/heads/master@{#25224} git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25224 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
jkummerow@chromium.org authored
(1) When we have just normalized and re-fastified a map, we don't need to copy it again to set the is_prototype bit. (2) When defining accessors causes a non-prototype object to go slow, don't force re-fastification. BUG=v8:3267 LOG=n R=verwaest@chromium.org Review URL: https://codereview.chromium.org/706243002 Cr-Commit-Position: refs/heads/master@{#25221} git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25221 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 14 Apr, 2014 1 commit
-
-
mstarzinger@chromium.org authored
R=rossberg@chromium.org TEST=mjsunit,test262,webkit Review URL: https://codereview.chromium.org/233083003 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20717 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 29 Nov, 2013 1 commit
-
-
mvstanton@chromium.org authored
Array builtins need to be prevented from changing frozen objects, and changing structure on sealed objects. BUG=299979 LOG=Y R=verwaest@chromium.org Review URL: https://codereview.chromium.org/80623002 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18164 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 27 May, 2013 1 commit
-
-
verwaest@chromium.org authored
The bug in the existing code was that it modified the |attributes| local variable on its way through the loop in CopyUpToAddAttributes. But that affected any properties updated after an accessor property. The code now sets up a mask each time and applies that instead of mutating |attributes|. R=verwaest@chromium.org Review URL: https://chromiumcodereview.appspot.com/16051002 Patch from Adam Klein <adamk@chromium.org>. git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14818 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 23 May, 2013 1 commit
-
-
verwaest@chromium.org authored
This patch both speeds up the freeze operation itself, but also allows properties to remain in fast mode. Objects with non-empty elements backing stores still end up with slow elements. Relanding r14758 and r14759 with fix for Test262: only mark properties and elements READ_ONLY if they are not JS setter/getters. Tightened up tests to assert frozen-ness, and added targeted tests for the new code (covering accessors). BUG=v8:1858, 115960 R=verwaest@chromium.org Review URL: https://chromiumcodereview.appspot.com/15691007 Patch from Adam Klein <adamk@chromium.org>. git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14762 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 22 May, 2013 3 commits
-
-
adamk@chromium.org authored
and "Fix Object.freeze on dictionary-backed arrays to properly freeze elements" This reverts r14758 and r14759 due to introducing failures in Test262 TBR=verwaest@chromium.org Review URL: https://codereview.chromium.org/15681004 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14760 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
adamk@chromium.org authored
Follow-up to r14758: slightly rearranges JSObject::Freeze() to avoid duplicating code while still retaining proper dictionary elements storage behavior. Also fix a lint error. R=verwaest@chromium.org Review URL: https://codereview.chromium.org/15737018 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14759 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
adamk@chromium.org authored
This patch both speeds up the freeze operation itself, but also allows properties to remain in fast mode. Objects with non-empty elements backing stores still end up with slow elements. BUG=v8:1858, 115960 R=verwaest@chromium.org Review URL: https://codereview.chromium.org/14888005 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14758 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 31 May, 2011 1 commit
-
-
ager@chromium.org authored
Our testing infrastructure uses exceptions to indicate errors. assertUnreachable therefore throws an exception to indicate that it was reached. Therefore, it cannot be used to check that an exception was thrown using the pattern: try { shouldThrow(); assertUnreachable(); } catch(e) { } Such a test will always pass because assertUnreachable will throw an exception if shouldThrow does not. R=ricow@chromium.org Review URL: http://codereview.chromium.org/7053035 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8117 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 28 Mar, 2011 1 commit
-
-
ricow@chromium.org authored
This change makes us compatible with Safari on not throwing when trying to add a property to a non-extensible object. Review URL: http://codereview.chromium.org/6712059 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7379 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 05 Aug, 2010 1 commit
-
-
sgjesse@chromium.org authored
BUG=http://code.google.com/p/v8/issues/detail?id=809 TEST=Seal/freeze an object and check if Object.seal and Object.freeze returns the given object. Burcu Dogan <burcujdogan@gmail.com> Review URL: http://codereview.chromium.org/3056049 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5176 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 14 Jul, 2010 1 commit
-
-
ricow@chromium.org authored
Since out internal representation of a property descriptor does not have configurable and writable attributes Object.isFrozen returns true whenever an object is not extensible. This change makes use of the right method calls on our internal representation (isWritable() and isConfigurable()). Tests added directly to the mjsunit test. Review URL: http://codereview.chromium.org/2904015 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5068 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 13 Jul, 2010 1 commit
-
-
ricow@chromium.org authored
This change adds ES5 15.2.3.9 Object.freeze and 15.2.3.12 Object.isFrozen Review URL: http://codereview.chromium.org/2944016 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5055 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-