- 02 Nov, 2018 10 commits
-
-
Tobias Tebbi authored
Bug: v8:8393 Change-Id: I6ab34cbe6c17f358c570e0bd27bf2de917f71b71 Reviewed-on: https://chromium-review.googlesource.com/c/1309764 Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Daniel Clifford <danno@chromium.org> Cr-Commit-Position: refs/heads/master@{#57211}
-
Georg Neis authored
... and use it in JSCallReducer. Bug: v8:7790 Change-Id: I1ff3d8d4d4a2936e6184ae5e842674117a96c7e2 Reviewed-on: https://chromium-review.googlesource.com/c/1314335Reviewed-by:
Maya Lekova <mslekova@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#57210}
-
Georg Neis authored
Bug: v8:7790 Change-Id: Ida292949c2a7f39726941ac4540569bf82487a3b Reviewed-on: https://chromium-review.googlesource.com/c/1314334Reviewed-by:
-
Hai Dang authored
This makes clear that some benchmarks where Array.from is used to clone the array are very fast because the array is COW, and the added benchmarks for non-COW arrays are not as fast. COW-ness does not affect benchmarks where Array.from is called with a callback function. Change-Id: Ie9dd5507df5dd7501ac955dba4d3682c4a54548e Reviewed-on: https://chromium-review.googlesource.com/c/1314333Reviewed-by:
Georg Neis <neis@chromium.org> Commit-Queue: Hai Dang <dhai@google.com> Cr-Commit-Position: refs/heads/master@{#57208}
-
Peter Marshall authored
We don't have any tests which run multiple isolates concurrently and starts a profiler in each of them. This test is a basic starting point so that we can check for flakiness caused by races or interrupts. The profiling mechanisms should be totally separate for two isolates, so this should (theoretically) not cause any problems. A use case for multiple isolates is for workers or in Node via cloud functions, so we should get some more coverage here. Change-Id: I0ca6d1296bc7bae7238c51b4487259d09e38d690 Reviewed-on: https://chromium-review.googlesource.com/c/1309823 Commit-Queue: Peter Marshall <petermarshall@chromium.org> Reviewed-by:
Alexei Filippov <alph@chromium.org> Cr-Commit-Position: refs/heads/master@{#57207}
-
Toon Verwaest authored
Restructure the code a little, and change how we detect sloppy block function redeclaration so we don't dereference a possibly nullptr function. Bug: chromium:900786 Change-Id: Ief124fe767603ca36f4dc8865c4aeb3e0635b4cf Reviewed-on: https://chromium-review.googlesource.com/c/1314331Reviewed-by:
Camillo Bruni <cbruni@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#57206}
-
Maya Lekova authored
This reverts commit 7350e7b2. Reason for revert: Braking layout test, blocking the roll, see https://bugs.chromium.org/p/v8/issues/detail?id=8405 Original change's description: > Get BytecodeArray via current frame where possible. > > With BytecodeArray flushing the SFI->BytecodeArray pointer will become pseudo weak. > Instead of getting the bytecode array from the SFI, get it from the frame instead > (which is a strong pointer). Note: This won't actually change behaviour since the > fact that the bytecode array was on the frame will retain it strongly, however it > makes the contract that the BytecodeArray must exist at these points more explicit. > > Updates code in runtime-profiler.cc, frames.cc and runtime-test.cc to do this. > > BUG=v8:8395 > > Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel;master.tryserver.blink:linux_trusty_blink_rel > Change-Id: Id7a3e6857abd0e89bf238e9b0b01de4461df54e1 > Reviewed-on: https://chromium-review.googlesource.com/c/1310193 > Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> > Reviewed-by: Mythri Alle <mythria@chromium.org> > Cr-Commit-Position: refs/heads/master@{#57198} TBR=rmcilroy@chromium.org,mythria@chromium.org Change-Id: Ie5db0ec1d68ca01d62e9880a4476704ad4d013b5 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:8395 Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel;master.tryserver.blink:linux_trusty_blink_rel Reviewed-on: https://chromium-review.googlesource.com/c/1314330Reviewed-by:
-
Benedikt Meurer authored
The fast-path in the `ArrayPrototypeLastIndexOf` torque implementation didn't check that the `fromIndex` is within the bounds of the JSArray _AFTER_ the call to ToInteger, which can have arbitrary side-effects, i.e. it can change the length of the array. R=yangguo@chromium.org Bug: chromium:898785 Change-Id: I7ef84143ec8c33148f6e9d451bd52769d5074fb4 Reviewed-on: https://chromium-review.googlesource.com/c/1314329Reviewed-by:
Yang Guo <yangguo@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#57204}
-
Frank Tang authored
Stage 1 of https://goo.gl/ooFdqJ Bug: v8:7958,v8:7960,v8:7961 Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng Change-Id: Iabc69e547760122699a526a1255cb42bf9ddacb4 Reviewed-on: https://chromium-review.googlesource.com/c/1212466 Commit-Queue: Frank Tang <ftang@chromium.org> Reviewed-by:
Sathya Gunasekaran <gsathya@chromium.org> Reviewed-by:
Aleksey Kozyatinskiy <kozyatinskiy@chromium.org> Cr-Commit-Position: refs/heads/master@{#57203}
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/3e568c8..6231c05 Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/f929109..971689c Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/0db62fc..fec80c4 TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org Change-Id: Iceb90cfe32d86cc6e45d0464cd726472b659d75e Reviewed-on: https://chromium-review.googlesource.com/c/1314108 Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Reviewed-by:
v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#57202}
-
- 01 Nov, 2018 7 commits
-
-
Frank Tang authored
Add a templates: Intl::GetStringOptionTo<> to simplify the reading of string from options. Add GetCaseFirst and GetHourCycle into Intl for later reuse by different Intl objects Move some enum shared by Intl object into Intl:: Bug: v8:5751 Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng Change-Id: If9ed1889a594f7c0ee6669b4679dda9169e4a771 Reviewed-on: https://chromium-review.googlesource.com/c/1297772Reviewed-by:
Adam Klein <adamk@chromium.org> Reviewed-by:
-
Frank Tang authored
To fix the to-be-landed-soon test262 test failure in test262/intl402/DateTimeFormat/prototype/resolvedOptions/order The spec change from "any order" to "table " order in https://github.com/tc39/ecma402/pull/279 Change the order of creating each property Move the code inside SetPropertyFromPattern into ResolvedOptions so we can easily follow the spec. Bug: v8:8379 Change-Id: Ibe9ea72a2557474fd81a9f350fffa298f4b7738f Reviewed-on: https://chromium-review.googlesource.com/c/1302803Reviewed-by:
-
Frank Tang authored
Change ListFormat.prototype.formatToParts to use FieldPositionIterator Bug: v8:8152 Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng Change-Id: I03e64f9843e55e624fa9ec090f5b3db7b4949f47 Reviewed-on: https://chromium-review.googlesource.com/c/1215273 Commit-Queue: Frank Tang <ftang@chromium.org> Reviewed-by:
-
Ross McIlroy authored
With BytecodeArray flushing the SFI->BytecodeArray pointer will become pseudo weak. Instead of getting the bytecode array from the SFI, get it from the frame instead (which is a strong pointer). Note: This won't actually change behaviour since the fact that the bytecode array was on the frame will retain it strongly, however it makes the contract that the BytecodeArray must exist at these points more explicit. Updates code in runtime-profiler.cc, frames.cc and runtime-test.cc to do this. BUG=v8:8395 Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel;master.tryserver.blink:linux_trusty_blink_rel Change-Id: Id7a3e6857abd0e89bf238e9b0b01de4461df54e1 Reviewed-on: https://chromium-review.googlesource.com/c/1310193 Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
Mythri Alle <mythria@chromium.org> Cr-Commit-Position: refs/heads/master@{#57198}
-
Jakob Kummerow authored
The previous AtomicElement wrapper fundamentally relied on reinterpret_casting a heap address to an instance of a C++ object, which is an invalid cast. This patch replaces that pattern with an ObjectSlot-based alternative that does not rely on UB. Bug: v8:3770 Change-Id: I62fb3c7589ac59e9e18139b525174de77e0e2149 Reviewed-on: https://chromium-review.googlesource.com/c/1309297 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#57197}
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/277ad43..3e568c8 Rolling v8/test/wasm-js/data: https://chromium.googlesource.com/external/github.com/WebAssembly/spec/+log/c90bc96..a56cf2e Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/5e1c1c2..f929109 Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/f170af4..0db62fc Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/3041f30..36daae0 TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org Change-Id: I57e0b3aa389b6a42d64134de607ee2e2267f04a4 Reviewed-on: https://chromium-review.googlesource.com/c/1312241Reviewed-by:
-
Frank Tang authored
Change the order of creating property for the return object of Intl.NumberFormat.property.resolvedOptions() according to the table in the spec. This is due to spec change in from "any order" to "table " in https://github.com/tc39/ecma402/pull/279 Failure w/o fixing it will happen once we land test262/intl402/NumberFormat/prototype/resolvedOptions/order Bug: v8:8378 Change-Id: Ic68fcfeba78af87d9bbd13c935ad9a91e76f4965 Reviewed-on: https://chromium-review.googlesource.com/c/1303195 Commit-Queue: Frank Tang <ftang@chromium.org> Reviewed-by:
-
- 31 Oct, 2018 23 commits
-
-
Jakob Kummerow authored
and reland "[ubsan] More Object** replacements" This reverts commit 162d4e6d. Reason for revert: Not the culprit, test failed before. Original change's description: > Revert "[ubsan] Replace Object** in GlobalHandles" > > This reverts commit 93927279. > > Reason for revert: Speculative revert, seems the most probable cause of > https://bugs.chromium.org/p/v8/issues/detail?id=8396 > > Revert "[ubsan] More Object** replacements" > > This reverts commit 5cce694d. > > Speculative revert. > > NOTRY=true > > Bug: v8:8396 > Change-Id: I9c2866a9db707cd03e4cf90822acde20813cebf0 > Reviewed-on: https://chromium-review.googlesource.com/c/1309761 > Commit-Queue: Maya Lekova <mslekova@chromium.org> > Reviewed-by: Yang Guo <yangguo@chromium.org> > Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> > Cr-Commit-Position: refs/heads/master@{#57174} TBR=yangguo@chromium.org,mstarzinger@chromium.org,mslekova@chromium.org Bug: v8:8396 Change-Id: I64fc80804b4ec324cef80ac528d08b724963f7f7 Reviewed-on: https://chromium-review.googlesource.com/c/1311813Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#57194}
-
Fabrice de Gans-Riberi authored
This was removed from gtest and is necessary to roll gtest in Chromium. TBR=adamk@chromium.org Bug: chromium:893369 Change-Id: I21762aa65ab2fc3f52731e7e812f0bf155f285e6 Reviewed-on: https://chromium-review.googlesource.com/c/1310598 Commit-Queue: Fabrice de Gans-Riberi <fdegans@chromium.org> Reviewed-by:
-
Daniel Clifford authored
This is preparation to support the Torque port of Object.fromEntries, including tests to make sure that the interface of the iterator functions is correct and compiles when used. Change-Id: I2a30ef80a80f42d4744a92746c8cd383abc10c19 Reviewed-on: https://chromium-review.googlesource.com/c/1303726 Commit-Queue: Daniel Clifford <danno@chromium.org> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#57192}
-
Frank Tang authored
Fix the broken test of the to-be-landed test262/intl402/ListFormat/prototype/resolvedOptions/order The ecma402 spec change from "any order" to "table " order in https://github.com/tc39/ecma402/pull/279 the intl* proposals will follow. Bug: v8:7871 Change-Id: If47ab44791920c23fe2e1101e60205589d0ac093 Reviewed-on: https://chromium-review.googlesource.com/c/1302058 Commit-Queue: Frank Tang <ftang@chromium.org> Reviewed-by:
-
Frank Tang authored
Bug: v8:8387 Change-Id: Ifd640603febddd32a778167bbce84e96539ac9c2 Reviewed-on: https://chromium-review.googlesource.com/c/1311373Reviewed-by:
Mathias Bynens <mathias@chromium.org> Commit-Queue: Frank Tang <ftang@chromium.org> Cr-Commit-Position: refs/heads/master@{#57190}
-
Tobias Tebbi authored
Bug: chromium:899029 Change-Id: I0fc724d5c77e5cbf2580de53f48934ae6f968934 Reviewed-on: https://chromium-review.googlesource.com/c/1310196Reviewed-by:
-
Frank Tang authored
The Intl.RelativeTimeFormat.prototype.formatToParts does not correctly implement the spec. Change the implementation by refactoring the JSNumber::FormatToParts and delegate part of the JSRelativeTimeFormat::FormatToParts to call the new refactored function. Bug: v8:8382 Change-Id: Ie153aa256ca78ce71c92efcdad55262564349ca9 Reviewed-on: https://chromium-review.googlesource.com/c/1305936 Commit-Queue: Frank Tang <ftang@chromium.org> Reviewed-by:
-
Junliang Yan authored
R=joransiu@ca.ibm.com Change-Id: I7d8f430df2f1f35145df7ba2326b3149d3193a60 Reviewed-on: https://chromium-review.googlesource.com/c/1297487 Commit-Queue: Junliang Yan <jyan@ca.ibm.com> Reviewed-by:
Joran Siu <joransiu@ca.ibm.com> Cr-Commit-Position: refs/heads/master@{#57187}
-
Toon Verwaest authored
Bug: chromium:900585 Change-Id: I2f6045ce23af9a15baddc73127b0c4e3e514841c Reviewed-on: https://chromium-review.googlesource.com/c/1310294 Commit-Queue: Maya Lekova <mslekova@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#57186}
-
Yang Guo authored
This reverts commit 5f9b9b99. Reason for revert: not longer necessary. Original change's description: > [tools] Temporarily make Node.js bot experimental > > R=sergiyb@chromium.org,yangguo@chromium.org > NOTRY=true > > Bug: v8:8397 > Change-Id: I528642fe0cf023fab7d653e9370a0d5a39a6bbb4 > Reviewed-on: https://chromium-review.googlesource.com/c/1310198 > Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org> > Commit-Queue: Maya Lekova <mslekova@chromium.org> > Cr-Commit-Position: refs/heads/master@{#57179} TBR=yangguo@chromium.org,sergiyb@chromium.org,mslekova@chromium.org Change-Id: Iaa14f5358f925313a450916c5caaa355b00e07be No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:8397 Reviewed-on: https://chromium-review.googlesource.com/c/1310873Reviewed-by:
-
Daniel Clifford authored
This is a reland of 0f15ed05 Original change's description: > [torque]: Implement catch handlers for try blocks > > In addition (and in combination), try statements now support "catch" > clauses at the end that catch JavaScript exceptions throw by any builtin > or runtime function contained in the try block: > > try { > ThrowTypeError(context, ...); > } > catch (e) { > // e has type Object > } > > Bug: v8:7793 > Change-Id: Ie285ff888c49c112276240f7360f70c8b540ed19 > Reviewed-on: https://chromium-review.googlesource.com/c/1302055 > Commit-Queue: Daniel Clifford <danno@chromium.org> > Reviewed-by: Tobias Tebbi <tebbi@chromium.org> > Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> > Cr-Commit-Position: refs/heads/master@{#57169} Bug: v8:7793 Change-Id: I3c4182303acfdfa625654976bec372cf531d954f Reviewed-on: https://chromium-review.googlesource.com/c/1310295Reviewed-by:
-
Toon Verwaest authored
Change-Id: I44ac330e093a4cbca4540a1948c9365c08f73914 Reviewed-on: https://chromium-review.googlesource.com/c/1310293Reviewed-by:
-
Toon Verwaest authored
We'd flatten upon compile anyway; and hashing the cons string also creates a local flattened version that's not cached. Change-Id: Ib5c82385ab009464b45bf1ceb289d04caaa77fcf Reviewed-on: https://chromium-review.googlesource.com/c/1309827Reviewed-by:
-
Alexey Kozyatinskiy authored
- introduced ValueMirror interface, this interface contains methods to generate different protocol entities, - introduced DebugPropertyIterator, this iterator iterates through object properties in the following order: exotic indices, enumerable strings, all other properties, - removed all injected script infra, e.g. closure compiler, R=dgozman@chromium.org TBR=yangguo@chromium.org Bug: chromium:595206 Change-Id: I030fdb3a80074ca6edd4749f86b39b590776ae6f Reviewed-on: https://chromium-review.googlesource.com/c/1310056Reviewed-by:
-
Alexei Filippov authored
JSON format does not support \xNN encoding. Use \uNNNN instead. + Add myself to the src/tracing/OWNERS BUG=chromium:895974 Change-Id: I410a09d44af08b61837579fa09d263d897b9385e Reviewed-on: https://chromium-review.googlesource.com/c/1303535Reviewed-by:
Dmitry Gozman <dgozman@chromium.org> Commit-Queue: Alexei Filippov <alph@chromium.org> Cr-Commit-Position: refs/heads/master@{#57180}
-
Maya Lekova authored
R=sergiyb@chromium.org,yangguo@chromium.org NOTRY=true Bug: v8:8397 Change-Id: I528642fe0cf023fab7d653e9370a0d5a39a6bbb4 Reviewed-on: https://chromium-review.googlesource.com/c/1310198Reviewed-by:
Sergiy Byelozyorov <sergiyb@chromium.org> Commit-Queue: Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/master@{#57179}
-
Michael Achenbach authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/49671d3..277ad43 Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/36a23a7..5e1c1c2 Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/cb629a4..f170af4 Rolling v8/third_party/icu: https://chromium.googlesource.com/chromium/deps/icu/+log/b029971..42d5027 Rolling v8/third_party/instrumented_libraries: https://chromium.googlesource.com/chromium/src/third_party/instrumented_libraries/+log/a90cbf3..a959e4f TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org Change-Id: I951bed28ed3181406ceab213cee37c473a7c0c7f Reviewed-on: https://chromium-review.googlesource.com/c/1309294Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Reviewed-by:
-
Maya Lekova authored
This reverts commit 0f15ed05. Reason for revert: Braking Node.js integration, see https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Linux64%20-%20node.js%20integration/3917 Original change's description: > [torque]: Implement catch handlers for try blocks > > In addition (and in combination), try statements now support "catch" > clauses at the end that catch JavaScript exceptions throw by any builtin > or runtime function contained in the try block: > > try { > ThrowTypeError(context, ...); > } > catch (e) { > // e has type Object > } > > Bug: v8:7793 > Change-Id: Ie285ff888c49c112276240f7360f70c8b540ed19 > Reviewed-on: https://chromium-review.googlesource.com/c/1302055 > Commit-Queue: Daniel Clifford <danno@chromium.org> > Reviewed-by: Tobias Tebbi <tebbi@chromium.org> > Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> > Cr-Commit-Position: refs/heads/master@{#57169} TBR=danno@chromium.org,mstarzinger@chromium.org,tebbi@chromium.org Change-Id: Ib9e3155ef46cc46851c4ca8a2624fd7634238e13 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:7793 Reviewed-on: https://chromium-review.googlesource.com/c/1310197Reviewed-by:
-
Aleksey Kozyatinskiy authored
This reverts commit 7e079c66. Reason for revert: native implementation should be ready for navigation. Original change's description: > inspector: move injected script source to native > > - introduced ValueMirror interface, this interface contains methods to generate > different protocol entities, > - introduced DebugPropertyIterator, this iterator iterates through object properties > in the following order: exotic indices, enumerable strings, all other properties, > - removed all injected script infra, e.g. closure compiler, > > R=dgozman@chromium.org > TBR=yangguo@chromium.org > > Bug: chromium:595206 > Change-Id: Idcfc04489ee52e015ad1d1d191c3474cc65e63f2 > Reviewed-on: https://chromium-review.googlesource.com/c/1308353 > Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org> > Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org> > Cr-Commit-Position: refs/heads/master@{#57150} TBR=dgozman@chromium.org,yangguo@chromium.org,kozyatinskiy@chromium.org Change-Id: I8c5c61f4cfe5a66cd33eadd02ab4acec539cc3bb No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: chromium:595206 Reviewed-on: https://chromium-review.googlesource.com/c/1310055Reviewed-by:
-
Maya Lekova authored
This reverts commit fd22cfc8. Reason for revert: Breaking MSAN build, see https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/23602 Original change's description: > [parser] Remove RETURN_IF* part 16 > > Bug: v8:8363, v8:7926 > Change-Id: I9f0b9e25cf6b47c8ff32451880e348b92ab3cfaa > Reviewed-on: https://chromium-review.googlesource.com/c/1309760 > Commit-Queue: Toon Verwaest <verwaest@chromium.org> > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Cr-Commit-Position: refs/heads/master@{#57172} TBR=ishell@chromium.org,verwaest@chromium.org Change-Id: Ic03a669c1a9598c7bd5ca186d783987e91dca5b5 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:8363, v8:7926 Reviewed-on: https://chromium-review.googlesource.com/c/1309828Reviewed-by:
-
Maya Lekova authored
This reverts commit 93927279. Reason for revert: Speculative revert, seems the most probable cause of https://bugs.chromium.org/p/v8/issues/detail?id=8396 Revert "[ubsan] More Object** replacements" This reverts commit 5cce694d. Speculative revert. NOTRY=true Bug: v8:8396 Change-Id: I9c2866a9db707cd03e4cf90822acde20813cebf0 Reviewed-on: https://chromium-review.googlesource.com/c/1309761 Commit-Queue: Maya Lekova <mslekova@chromium.org> Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#57174}
-
Georg Neis authored
The slow path in Runtime_ArrayIndexOf allocates handles in each iteration over the input object. This CL gives each iteration its own handle scope in order to avoid consuming more and more memory the longer the loop runs. This can be observed e.g. by executing console.log(new Proxy(new Array(2**30), {}).indexOf(42)) which used to run out of memory on my machine. Bug: v8:8386 Change-Id: Idab98ef7e1e4047c21c1dc0e01ba2d3d363c1f09 Reviewed-on: https://chromium-review.googlesource.com/c/1309759 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#57173}
-
Toon Verwaest authored
Bug: v8:8363, v8:7926 Change-Id: I9f0b9e25cf6b47c8ff32451880e348b92ab3cfaa Reviewed-on: https://chromium-review.googlesource.com/c/1309760 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Reviewed-by:
-
