- 30 Oct, 2018 12 commits
-
-
Marja Hölttä authored
These tests rely on dropping references to objects either explicitly ("o = null;") or implicitly ("o goes out of scope") and then doing gc. It's essential that we haven't already marked the WeakCell pointing to o and marked it alive before dropping the reference. BUG=v8:8179 Change-Id: Ie0b73f05c4baa937cf6f28325454ff9087a71a2c Reviewed-on: https://chromium-review.googlesource.com/c/1306437Reviewed-by:Ulan Degenbaev <ulan@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/master@{#57115}
-
Peter Marshall authored
If a caller starts the sampling heap profiler and takes a snapshot, and then deletes the snapshot before the sampling has completed, a use-after-free will occur on the StringsStorage pointer. The same issue applies for StartTrackingHeapObjects which shares the same StringsStorage object. Bug: v8:8373 Change-Id: I5d69d60d3f9465f9dd3b3bef107c204e0fda0643 Reviewed-on: https://chromium-review.googlesource.com/c/1301477 Commit-Queue: Peter Marshall <petermarshall@chromium.org> Reviewed-by:
Alexei Filippov <alph@chromium.org> Cr-Commit-Position: refs/heads/master@{#57114}
-
Stephan Herhut authored
Turns out TryReuseSpillForPhi does more than reusing a spill slot for a phi (which is beneficial in general). It also decides whether a phi should start out to be allocated in a spill slot. The latter, of course, benefits from control flow knowledge. Hence, this change was detrimental in cases where a common input to a phi is only spilled on few control flow pathes. To fix, we need to disentangle spill-slot reuse and the decision whether a phi should start out spilled. I will look into this in a follow up change. This reverts commit b79cbd56. Change-Id: I228185bb1a4b320d3115ba7f1d921593480d8e7d Reviewed-on: https://chromium-review.googlesource.com/c/1304549Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Stephan Herhut <herhut@chromium.org> Cr-Commit-Position: refs/heads/master@{#57113}
-
Ivica Bogosavljevic authored
MIPS64 is a 64-bit platform and each user space process can address 2^42 bytes of memory. This fixes the current behavior when the address range was limited to 2^30, which is the default value taken for 32-bit platforms. Change-Id: I310e16631a4dfaf77416e278ddf4386f3e258cc3 Reviewed-on: https://chromium-review.googlesource.com/c/1304197Reviewed-by:
Hannes Payer <hpayer@chromium.org> Commit-Queue: Ivica Bogosavljevic <ibogosavljevic@wavecomp.com> Cr-Commit-Position: refs/heads/master@{#57112}
-
Sigurd Schneider authored
Change-Id: I6a220b6043da8f9c8c036c92e3f4da6ca7d801d4 Bug: v8:8344 Reviewed-on: https://chromium-review.googlesource.com/c/1306436Reviewed-by:
-
Benedikt Meurer authored
This adds appropriate LoopExit nodes for the JSCallReducer lowerings of the following higher order Array builtins: - Array.prototype.every() - Array.prototype.find() - Array.prototype.findIndex() - Array.prototype.some() Loop peeling allows TurboFan to make loop invariant operations in the callback passed to the higher order builtin fully redundant, and thus completely eliminate the loop invariant code from the subsequent loop iterations. This can have a huge performance impact, depending on what kind of code runs inside of the callback. For example, on the micro- benchmarks outlined in http://crbug.com/v8/8273 we go from forLoop: 364 ms. every: 443 ms. some: 432 ms. find: 522 ms. findIndex: 437 ms. to forLoop: 369 ms. every: 354 ms. some: 348 ms. find: 419 ms. findIndex: 360 ms. which is 20% improvement, and essentially brings the Array builtins (the appropriate ones Array#some() and Array#every() in this case) on par with the hand-written `for`-loop. Bug: v8:1956, v8:8273 Change-Id: I9d32736e5402807b4ac79cd5ad15ceacd1945681 Reviewed-on: https://chromium-review.googlesource.com/c/1305935Reviewed-by:
Daniel Clifford <danno@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#57110}
-
Sigurd Schneider authored
Change-Id: Iba905f4c1f2e5aff70953bdfb0009b417a959a41 Bug: v8:8344 Reviewed-on: https://chromium-review.googlesource.com/c/1304548Reviewed-by:
-
Benedikt Meurer authored
Be more consistent for elements kinds and polymorphism in various Array builtins, which are only iterating over elements. Bug: v8:1956 Change-Id: I0c02a1b18d95e678e01b816aa36b259a3ba76170 Reviewed-on: https://chromium-review.googlesource.com/c/1306434Reviewed-by:
Sigurd Schneider <sigurds@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#57108}
-
Sigurd Schneider authored
Change-Id: Ic0513662eed0bd47bbc8c2ecec8fadd6b62f58f5 Bug: v8:8344 Reviewed-on: https://chromium-review.googlesource.com/c/1304550Reviewed-by:
-
Igor Sheludko authored
and use Mixin pattern with linear inheritance instead. This will allow to customize the way the Isolate is created. Bug: v8:8238 Change-Id: Ic611df123653af3a0f2271394387492e440b5ea8 Reviewed-on: https://chromium-review.googlesource.com/c/1306433Reviewed-by:
-
Jungshik Shin authored
In Chromium tree, ICU is rolled to 63.1. And, auto-roller will soon try to roll ICU in v8 to 63.1. Due to a nodejs trybot issue, autoroll needs a manual intervention. In the meantime, this CL will get rid of other blocking issues for ICU update. Prepare for the ICU roll by revising test/intl as following: * Line breaking loose mode is now supported in the Chromium's copy of ICU. Adjust the test expectation. * ICU's uloc_* can handle overlong locale ids. Drop tests that are not valid any more. Once ICU is rolled, a couple of TSAN-suppressed tests can be unsuppressed, but that has to be done in a separate CL. Bug: chromium:893196,v8:8272, v8:8110 Test: intl/*, test262/test402/* Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng Change-Id: I17f11457b61376b1e8d41bbbc951fa6cd3355a54 Reviewed-on: https://chromium-review.googlesource.com/c/1289369 Commit-Queue: Jungshik Shin <jshin@chromium.org> Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Reviewed-by:
Sathya Gunasekaran <gsathya@chromium.org> Cr-Commit-Position: refs/heads/master@{#57105}
-
Frank Tang authored
Fix the to be-landed-soon test262 test failure in test262/intl402/Collator/prototype/resolvedOptions/order The spec changed from "any order" to "table " order in https://github.com/tc39/ecma402/pull/279 Bug: v8:8378 Change-Id: I76cfb27ab4219911e6ab2de97f0f34318d5430a3 Reviewed-on: https://chromium-review.googlesource.com/c/1302801 Commit-Queue: Frank Tang <ftang@chromium.org> Reviewed-by:
-
- 29 Oct, 2018 28 commits
-
-
Marja Hölttä authored
If PreParser::ParseFormalParameterList detects a stack overflow, make PreParseFunction actually return kPreParseStackOverflow. BUG=chromium:899495 Change-Id: I1f347b56c594c6edd25401b8448ff38117e190a9 Reviewed-on: https://chromium-review.googlesource.com/c/1304536 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#57103}
-
Hannes Payer authored
Change-Id: I65b5f879bfc1efb2ed3178cdfcb3b6a03b91e12a Reviewed-on: https://chromium-review.googlesource.com/c/1305933Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Hannes Payer <hpayer@chromium.org> Cr-Commit-Position: refs/heads/master@{#57102}
-
Tobias Tebbi authored
Bug: chromium:899535 Change-Id: I468912afca9187b47ae94fbbcff79e175fa1e686 Reviewed-on: https://chromium-review.googlesource.com/c/1304296Reviewed-by:
Caitlin Potter <caitp@igalia.com> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#57101}
-
Frank Tang authored
Change the order of the output and add spec text. To fix the to-be-landed-soon test262 test failure in test262/intl402/Segmenter/prototype/resolvedOptions/order The spec change from "any order" to "table " order in https://github.com/tc39/ecma402/pull/279 Bug: v8:8376 Change-Id: Ife19aec4386a022168514053830ebe03f983f4a9 Reviewed-on: https://chromium-review.googlesource.com/c/1301646Reviewed-by:
-
Frank Tang authored
This will give us some clusterfuzz coverage. Bug: v8:6891 Change-Id: I167774aeb0110bde8d5ed1047b2875b14317903b Reviewed-on: https://chromium-review.googlesource.com/c/1301643Reviewed-by:
-
Hannes Payer authored
Bug: chromium:897074 Change-Id: I8f886647eaab80a6d283b3f1aef6575f36327ec7 Reviewed-on: https://chromium-review.googlesource.com/c/1304543Reviewed-by:
-
Junliang Yan authored
R=joransiu@ca.ibm.com Change-Id: I071409177a0a33ad90c38c787d867461be5085a9 Reviewed-on: https://chromium-review.googlesource.com/c/1302802Reviewed-by:
Joran Siu <joransiu@ca.ibm.com> Commit-Queue: Junliang Yan <jyan@ca.ibm.com> Cr-Commit-Position: refs/heads/master@{#57097}
-
Michael Starzinger authored
R=clemensh@chromium.org Change-Id: If7d1237bd65b58eaf7fe305f8539a6663b748b05 Reviewed-on: https://chromium-review.googlesource.com/c/1304541Reviewed-by:
Clemens Hammacher <clemensh@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#57096}
-
Benedikt Meurer authored
This introduces Word64 support for the CheckBounds operator, which now lowers to either CheckedUint32Bounds or CheckedUint64Bounds after the representation selection. The right hand side of CheckBounds can now be any positive safe integer on 64-bit architectures, whereas it remains Unsigned31 for 32-bit architectures. We only use the extended Word64 support when the right hand side is outside the Unsigned31 range, so for everything except DataViews this means that the performance should remain the same. The typing rule for the CheckBounds operator was updated to reflect this new behavior. The CheckBounds with a right hand side outside the Unsigned31 range will pass a new Signed64 feedback kind, which is handled with newly introduced CheckedFloat64ToInt64 and CheckedTaggedToInt64 operators in representation selection. The JSCallReducer lowering for DataView getType()/setType() methods was updated to not smi-check the [[ByteLength]] and [[ByteOffset]] anymore, but instead just use the raw uintptr_t values and operate on any value (for 64-bit architectures these fields can hold any positive safe integer, for 32-bit architectures it's limited to Unsigned31 range as before). This means that V8 can now handle huge DataViews fully, without falling off a performance cliff. This refactoring even gave us some performance improvements, on a simple micro-benchmark just exercising different DataView accesses we go from testDataViewGetUint8: 796 ms. testDataViewGetUint16: 997 ms. testDataViewGetInt32: 994 ms. testDataViewGetFloat64: 997 ms. to testDataViewGetUint8: 895 ms. testDataViewGetUint16: 889 ms. testDataViewGetInt32: 888 ms. testDataViewGetFloat64: 890 ms. meaning we lost around 10% on the single byte case, but gained 10% across the board for all the other element sizes. Design-Document: http://bit.ly/turbofan-word64 Bug: chromium:225811, v8:4153, v8:7881, v8:8171, v8:8383 Change-Id: Ic9d1bf152e47802c04dcfd679372e5c85e4abc83 Reviewed-on: https://chromium-review.googlesource.com/c/1303732Reviewed-by:
-
Maya Lekova authored
This reverts commit bf3d7b9a. Reason for revert: Breaks TSAN build, see https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Linux64%20TSAN/23248 Original change's description: > [wasm] Store compile errors in CompilationState > > We are currently storing compilation errors in the individual > compilation units and pass it to the ErrorThrower during finishing. > This CL changes that to store errors on the CompilationState directly. > From there, it is propagated to the ErrorThrower in the compilation > state callback. > This removes more work from the finisher task and slims down the > WasmCompilationUnits. > > R=mstarzinger@chromium.org > > Bug: v8:8343, v8:7921 > Change-Id: Id332add43d4219d2a30fee653ed4e53a9b2698d9 > Reviewed-on: https://chromium-review.googlesource.com/c/1303720 > Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> > Commit-Queue: Clemens Hammacher <clemensh@chromium.org> > Cr-Commit-Position: refs/heads/master@{#57091} TBR=mstarzinger@chromium.org,clemensh@chromium.org Change-Id: Id32c7337494a4749485adbcfcaae7b2331afea66 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:8343, v8:7921 Reviewed-on: https://chromium-review.googlesource.com/c/1304544Reviewed-by:
Maya Lekova <mslekova@chromium.org> Commit-Queue: Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/master@{#57094}
-
Stephan Herhut authored
As the wasm compilation pipeline skips the start and end phase of normal pipelines, we do not log compilation start/end for functions, which makes reading log output more complicated than need be. Change-Id: I1566ab7428b2dd9763c443000e946d4c6c789626 Reviewed-on: https://chromium-review.googlesource.com/c/1304540Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Commit-Queue: Stephan Herhut <herhut@chromium.org> Cr-Commit-Position: refs/heads/master@{#57093}
-
Clemens Hammacher authored
This removes more parameters which can be queried from the NativeModule. R=titzer@chromium.org Bug: v8:8343 Change-Id: Ia5111a336e8e2272f189ff2c5523afec8b2de660 Reviewed-on: https://chromium-review.googlesource.com/c/1303723Reviewed-by:
Ben Titzer <titzer@chromium.org> Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#57092}
-
Clemens Hammacher authored
We are currently storing compilation errors in the individual compilation units and pass it to the ErrorThrower during finishing. This CL changes that to store errors on the CompilationState directly. From there, it is propagated to the ErrorThrower in the compilation state callback. This removes more work from the finisher task and slims down the WasmCompilationUnits. R=mstarzinger@chromium.org Bug: v8:8343, v8:7921 Change-Id: Id332add43d4219d2a30fee653ed4e53a9b2698d9 Reviewed-on: https://chromium-review.googlesource.com/c/1303720Reviewed-by:
-
Benedikt Meurer authored
For NumberMin and NumberMax we don't need to go to Float64 when the inputs are known to be in SafeInteger range, instead we can go to Word64 on 64-bit architectures. This is preliminary work for the huge DataView support, since we'll utilize NumberMax in that case to clamp the limit for the bounds check. Bug: v8:8178, v8:8383 Change-Id: I414114229c5c86b92749d30d645cedc641541ae4 Reviewed-on: https://chromium-review.googlesource.com/c/1304535Reviewed-by:
-
Clemens Hammacher authored
The "grow_memory" opcode was renamed to "memory.grow", and the spec repo was updated to use kExprMemoryGrow internally instead of kExprGrowMemory (https://github.com/WebAssembly/spec/pull/720). This CL does the same change for v8. Drive-by: Rename "current_size" to "memory.size", and a minor cleanup in wasm-graph-builder.js to bring it in line with the version in the js-api tests in the spec repo. R=titzer@chromium.org Change-Id: If525dba898b2c248890a616d3392c22b45f698ef Reviewed-on: https://chromium-review.googlesource.com/c/1302057Reviewed-by:
-
Sigurd Schneider authored
Change-Id: Ia970b1281d73289812c4f83c722eea87c31863ba Bug: v8:8344 Reviewed-on: https://chromium-review.googlesource.com/c/1304534Reviewed-by:
-
Toon Verwaest authored
Bug: v8:8363, v8:7926 Change-Id: Icfc8c02573a92d655ee14f563ad9c67fe5655029 Reviewed-on: https://chromium-review.googlesource.com/c/1304440 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#57087}
-
Sigurd Schneider authored
Change-Id: I21a87236c5a65bfd44da10efa57063e2a96e3779 Bug: v8:8344 Reviewed-on: https://chromium-review.googlesource.com/c/1304533Reviewed-by:
-
Toon Verwaest authored
Fix: Skip sanity check of illegal tokens Additional fix: set c0_ to kEndOfInput Bug: v8:8363, v8:7926 Change-Id: I4f1222945914462e495d9ed6b86d38e478adbe39 Reviewed-on: https://chromium-review.googlesource.com/c/1304298 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Reviewed-by:
Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/master@{#57085}
-
Michael Starzinger authored
This fixes the fall-back case when parsing a multiplicative expression where the lookahead found a '-' token followed by an unsigned token, but no '*' token is following. We cannot rewind both tokens, but still need to make sure that a full multiplicative expression is parsed. R=clemensh@chromium.org TEST=mjsunit/regress/regress-8377 BUG=v8:8377 Change-Id: I20ce6267445b32bdaf03f41f11d9ef4be66cb636 Reviewed-on: https://chromium-review.googlesource.com/c/1304317Reviewed-by:
-
Clemens Hammacher authored
The Counters are not specific to compilation units, they just happen to be used in WasmCompilationUnit::ExecuteCompilation. Remove it from the compilation unit and pass it explicitly where needed. This saves another field on the compilation units. R=titzer@chromium.org Bug: v8:8343 Change-Id: Iad4fd8ae23b022c237535503e0e805db7e67071a Reviewed-on: https://chromium-review.googlesource.com/c/1304297 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
-
Marja Hölttä authored
The bug was that PreParser detected a stack overflow and an unidentifiable error, and we tried to re-parse the same code. However, the stack overflow flag was still set, and that messed up error handling in the Parser. BUG=chromium:899495 Change-Id: Icdef74bdb8be252d75f245e243e1303ffb822ce2 Reviewed-on: https://chromium-review.googlesource.com/c/1304316Reviewed-by:
-
Marja Hölttä authored
- Store dirty JSWeakFactories in a heap root (not native context) - during GC there's no native context necessarily. - Schedule one microtask per JSWeakFactory. - Enter the context of the cleanup function before calling it. BUG=v8:8179 Change-Id: Icaa245a08a60dd7325af828858ebe55d842c5bf6 Reviewed-on: https://chromium-review.googlesource.com/c/1298899 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by:
-
Clemens Hammacher authored
Move some methods to transitions-inl.h to avoid using methods defined in other inl headers. R=verwaest@chromium.org Bug: v8:7965 Change-Id: I0f5a97ffa4c5faad1687c1586ef2dbf5193939bb Reviewed-on: https://chromium-review.googlesource.com/c/1303299 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
-
Clemens Hammacher authored
R=jgruber@chromium.org Bug: v8:7965 Change-Id: Icad6d0f2e43d8c5bb62ad160a186b1d3dbd57781 Reviewed-on: https://chromium-review.googlesource.com/c/1303298 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#57079}
-
Clemens Hammacher authored
They are only needed in the async DecodeModule step. We can just store a raw pointer to the Counters there. R=mstarzinger@chromium.org Bug: v8:8238 Change-Id: I2b22008fc4cbf6f8f69c9d53822fdb5af7d638f6 Reviewed-on: https://chromium-review.googlesource.com/c/1303302 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
-
Clemens Hammacher authored
R=yangguo@chromium.org Bug: v8:7965 Change-Id: I38d636b29bc6a8eebafc8299b24954bedb3cafec Reviewed-on: https://chromium-review.googlesource.com/c/1303719 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
Yang Guo <yangguo@chromium.org> Cr-Commit-Position: refs/heads/master@{#57077}
-
Clemens Hammacher authored
See discussion after this CL: https://crrev.com/c/1297960 We want to avoid the link from NativeModule to WasmEngine to enforce encapsulation. If someone needs access to the WasmEngine, we should give them a direct pointer. R=titzer@chromium.org Bug: v8:8217 Change-Id: I5bb6f4bf9b56c43085786d7092151d51bd0ff3ca Reviewed-on: https://chromium-review.googlesource.com/c/1304433Reviewed-by:
-
