- 08 Jul, 2019 5 commits
-
-
Simon Zünd authored
This CL mitigates the worst performance regressions for stack trace symbolization. The first fix is to hold the StackFrameBase instance in a local variable. The instance is produced by an iterator but newly created everytime FrameArrayIterator::Frame is called. The second fix is to skip symbolization of "MethodName" and "TypeName" for non-method calls. R=ulan@chromium.org Bug: chromium:981541,v8:8742 Change-Id: I58b2e0c87693c3914cf1946ce56341fbd4a797ac Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1688927 Commit-Queue: Simon Zünd <szuend@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#62549}
-
Nico Hartmann authored
Feedback shall not be updated by the deoptimizer. Although this mechanism exists, it shall not be used if possible. This CL changes how V8 learns from BigInt deopts: Previously we updated feedback on the BinaryOperations in the deoptimizer, now we let the interpreter widen the feedback type from BigInt to Any after the deopt has occurred. Bug: v8:9407 Change-Id: I92e5e733085b433fd8ab452674d02404b81b2796 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687419Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Reviewed-by:
Sigurd Schneider <sigurds@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@google.com> Cr-Commit-Position: refs/heads/master@{#62548}
-
Simon Zünd authored
This CL teaches the deoptimizer about JavaScriptBuiltinContinuation frames that are not preceded by argument adapter frames. This pattern is used when calling C++ API functions from TurboFan. This CL fixes a crash when the deoptimizer encounters the pattern described above. The crash was caused when the deoptimizer tried to read the arguments of the continuation frame. As no adapter frame was present, the argument count was read from the SharedFunctionInfo which had the kDontAdaptArgumentsSentinel value. This translated to an argument count of ~65000 later down the line, which caused a FATAL error when the deoptimizer tried to re-construct ~65000 non-existent values. Bug: chromium:980529 Change-Id: Id2de3bf7607102ab5a16de344c649015e968b185 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687417Reviewed-by:
-
Georg Neis authored
Change-Id: I9285052dfe21df8e0eaf0e0493458532f82504ae Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687421Reviewed-by:
Mythri Alle <mythria@chromium.org> Reviewed-by:
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/e10ba67..bd69e87 TBR=machenbach@chromium.org,sergiyb@chromium.org,tmrts@chromium.org Change-Id: I7a6ed22c9ff03cf3ccee1092a6a008527aa8bddb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1690690Reviewed-by:
v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#62545}
-
- 07 Jul, 2019 1 commit
-
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/7001f69..e10ba67 TBR=machenbach@chromium.org,sergiyb@chromium.org,tmrts@chromium.org Change-Id: I8363e4afe58742ae37fa5cb473772e2dbae36307 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1688007Reviewed-by:
-
- 06 Jul, 2019 1 commit
-
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/2bdfcbd..7001f69 Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/4303074..dd686e3 TBR=machenbach@chromium.org,sergiyb@chromium.org,tmrts@chromium.org Change-Id: I0a13e552cb4d7a20c25b230f5b03dfac22195111 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1688004Reviewed-by:
-
- 05 Jul, 2019 13 commits
-
-
Michael Achenbach authored
Bug: v8:9440 Change-Id: I0428ddbc26c06106fc504554f85c5f9c08871c18 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687418Reviewed-by:
Maya Lekova <mslekova@chromium.org> Reviewed-by:
Tamer Tas <tmrts@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/master@{#62542}
-
Maya Lekova authored
Got rid of the following circular header dependency chains: compilation-dependencies <-> js-heap-broker <-> access-info types <-> js-heap-broker <-> access-info Extracted former CompilationDependencies::Dependency class into its own header. Extracted *Ref classes into their own header. This should enable building on older GCC versions, e.g. 5.4.0. Bug: v8:9440 Change-Id: Ia345bc227d8f7806d0b8622b706346a7ce6d01ea Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687415 Commit-Queue: Maya Lekova <mslekova@chromium.org> Reviewed-by:
Michael Stanton <mvstanton@chromium.org> Cr-Commit-Position: refs/heads/master@{#62541}
-
Maciej Goszczycki authored
Once read-only space is not a Heap space it makes little sense to have it in the Heap class. Bug: v8:7464 Change-Id: I2230ce7cbf1cec3c83065c91bc14a9c23f72478b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1688841Reviewed-by:
Dan Elphick <delphick@chromium.org> Reviewed-by:
-
Leszek Swirski authored
Introduces LazyLoadICParameters which allow a LazyNode for context and name. These aren't used on the fast path, so we want to avoid reading them for both performance and register pressure reasons. Change-Id: Ifb637cf4782ce984feee9af503998e7539beb823 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1686665 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#62539}
-
Sigurd Schneider authored
The functionality is identical and AddEmbeddedObject makes more effort to deduplicate handles. Change-Id: I3d0468da28596aad09ceceb320ca4038aed60bd4 Bug: v8:8054, v8:8977, v8:7703 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1672925 Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#62538}
-
Georg Neis authored
- Always account for small functions. - Always check against the hard limit. - Rename some things for clarity. Change-Id: Iad98ee625d4385dfab02fb7d5e0cb2c25eb5d67a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1686664Reviewed-by:
-
Sigurd Schneider authored
And make --trace-turbo-alloc honor --trace-turbo-filter This is useful to filter out a specific compile job, e.g. if mksnapshot is crashing it easily produces 5GB of logs without filter. TBR=bmeurer@chromium.org Change-Id: Ic7dea0a4cef793b517d98ca2ba1f6ea6eeac63ea Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1521111 Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/master@{#62536}
-
Clemens Hammacher authored
Registration of trap handler data has to happen *before* updating the jump table, otherwise other threads might start using the code right away, and if they hit a memory OOB, they just segfault if the trap handlers have not been registered yet. R=ahaas@chromium.org Bug: v8:9375, chromium:980843 Change-Id: Ifac5c0681ce133b7af730a87beaede9d3c223f50 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687414Reviewed-by:
Andreas Haas <ahaas@chromium.org> Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#62535}
-
Maya Lekova authored
This reverts commit f24e9958. Reason for revert: Speculative revert for https://bugs.chromium.org/p/chromium/issues/detail?id=981138 Original change's description: > [snapshot] Add '.note.GNU-stack' marker section for ELF snapshots > > This snapshot adds a marker section to the output assembly of > mksnapshot. Omitting this section can imply an executable stack, which > can result in linker warnings. > > R=jgruber@chromium.org > > Change-Id: I6f5dacb24de3a852faf6ce0caf18c32b499ba5a9 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687669 > Commit-Queue: Simon Zünd <szuend@chromium.org> > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > Cr-Commit-Position: refs/heads/master@{#62504} TBR=jgruber@chromium.org,szuend@chromium.org # Not skipping CQ checks because original CL landed > 1 day ago. Bug: chromium:981138 Change-Id: Iad05bb8e4222d62db8266ae250d79a37259f3008 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687416Reviewed-by:
Simon Zünd <szuend@chromium.org> Reviewed-by:
-
Andreas Haas authored
No WasmIndirectFunctionTable is needed for table 0, because table 0 is handled specially: The WasmIndirectFunctionTable gets inlined into the instance in this case. R=mstarzinger@chromium.org Bug: chromium:980854 Change-Id: I604a52e0f3b9a8fff1b2e8190c76178d2f1052c1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687894Reviewed-by:
-
Benedikt Meurer authored
When `this` is context allocated inside a class constructor (strict mode function), due to an arrow function, debug evaluate was unable to locate the value. This is quick fix for the issue, which probably deserves a more general rewrite at some later point in time (with more domain expertise). Bug: chromium:760225 Change-Id: I5208d8a202ad69439f60ada480599d0efcdc4ce4 Cq-Include-Trybots: luci.chromium.try:linux-rel,win7-rel Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687412 Commit-Queue: Yang Guo <yangguo@chromium.org> Reviewed-by:
Yang Guo <yangguo@chromium.org> Auto-Submit: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#62532}
-
Michael Achenbach authored
But does not change to xenial for test using armv7l cpu. Bug: chromium:954890 Change-Id: I02268f469001f197210cde9c63804a3dcea06a7f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687831 Commit-Queue: Michael Achenbach <machenbach@chromium.org> Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Auto-Submit: Takuto Ikuta <tikuta@chromium.org> Cr-Commit-Position: refs/heads/master@{#62531}
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/293721c..2bdfcbd Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/c2577db..4303074 Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/2aa3ab5..92afaf5 TBR=machenbach@chromium.org,sergiyb@chromium.org,tmrts@chromium.org Change-Id: I0c4bc52e340d44b66a3c75774480cf097e00b662 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687995Reviewed-by:
-
- 04 Jul, 2019 9 commits
-
-
Milad Farazmand authored
This reverts commit fb3445dc. Reason for revert: <INSERT REASONING HERE> Original change's description: > s390: cleanup TM family instructions > > Change-Id: I6ba7a4d72c79b8237c63eef750d7991c4f82ab12 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1685030 > Commit-Queue: Junliang Yan <jyan@ca.ibm.com> > Reviewed-by: Junliang Yan <jyan@ca.ibm.com> > Cr-Commit-Position: refs/heads/master@{#62524} TBR=jyan@ca.ibm.com,yang.qin@ibm.com Change-Id: Ibedeeb51d4acd7ca089fda6d80ce5b49bc210974 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687021Reviewed-by:
Milad Farazmand <miladfar@ca.ibm.com> Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com> Cr-Commit-Position: refs/heads/master@{#62529}
-
Leszek Swirski authored
Reduce register pressure (and therefore spills) across the loop iterating over the LoadIC polymorphic feedback array by starting at length - 1 and iterating down to 0. Might give a tiny recency boost too. Change-Id: I1295a8136212c339b9d3974e2d49b3ecfe1ce543 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687545Reviewed-by:
-
Santiago Aboy Solanes authored
This will be used to test InterpreterEntryTrampoline Change-Id: I2ee2cffea0741e15597a7e31f70e156e9aaa1c2d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1688890Reviewed-by:
-
Leszek Swirski authored
Change-Id: If92be5414d42e127df80de1695cb1ebb5d454fab Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687890Reviewed-by:
Santiago Aboy Solanes <solanes@chromium.org> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/master@{#62526}
-
Dan Elphick authored
Use the position of the next parameter to be declared as the end of the initializer for default parameters, so that hole checks can be elided for initializers using previous parameters in arrow functions. This fixes a source of bytecode mismatches when collecting source positions lazily. Bug: chromium:980422, v8:8510 Change-Id: I5ab074231248b661156e7d8e47c01685448b56d5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1683267Reviewed-by:
-
Yang Qin authored
Change-Id: I6ba7a4d72c79b8237c63eef750d7991c4f82ab12 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1685030 Commit-Queue: Junliang Yan <jyan@ca.ibm.com> Reviewed-by:
Junliang Yan <jyan@ca.ibm.com> Cr-Commit-Position: refs/heads/master@{#62524}
-
Santiago Aboy Solanes authored
Change-Id: I154b7705fe9750ed16166c50a22cd16b0abc0425 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687889 Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Reviewed-by:
-
Simon Zünd authored
This CL moves the code responsible for serializing a stack trace frame into a string, out of messages.cc and into stack-frame-info.cc. Instead of symbolizing the stack trace frame while serializing, the code is changed to work on top of StackTraceFrame and StackFrameInfo objects. The result is that the serialization code no longer cares when a stack trace frame is symbolized. Symbolization could happen eagerly during capturing, or lazily the first time any of StackFrameInfo fields are accessed. Drive-by: Existing users of StackFrameBase::ToString are adapted to the new SerializeStackTraceFrame API. This includes Isolate::PrintCurrentStackTrace, which is changed to re-use the existing capturing and serializing mechanism. Bug: v8:8742 Change-Id: Ic7fd80668c9d993e99d586ef7fe022850104c34f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1631414 Commit-Queue: Simon Zünd <szuend@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#62522}
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/ce1ed5f..293721c Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/63f7fcc..c2577db Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/f21ffb4..2aa3ab5 TBR=machenbach@chromium.org,sergiyb@chromium.org,tmrts@chromium.org Change-Id: Ib989e2f01d1cb25d39d48a77ca4c54c479c53c63 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687994Reviewed-by:
-
- 03 Jul, 2019 11 commits
-
-
Ng Zhi An authored
Bug: v8:8460 Change-Id: I8ab46f3bba5e298db717ce46c848ad2d7f753686 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1684425 Commit-Queue: Zhi An Ng <zhin@chromium.org> Reviewed-by:
Deepti Gandluri <gdeepti@chromium.org> Cr-Commit-Position: refs/heads/master@{#62520}
-
Mike Stanton authored
In native context specialization, reducing a JSResolvePromise node requires us to know that there are no "then" properties on the resolution object's maps. This work must be done at serialization time. Bug: v8:7790 Change-Id: If905513a028bc3d71379e2a31e86fff1d3383141 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1666988Reviewed-by:
-
Ng Zhi An authored
Bug: v8:8460 Change-Id: I8be7244f19fbb48371c3ad12631e0da71e6321d4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1682432Reviewed-by:
-
Yun Liu authored
Bug: chromium:428426 Change-Id: If50b417084f5b32390cc2ad4fd50077ea4d23b8f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1684219Reviewed-by:
Sergiy Belozorov <sergiyb@chromium.org> Commit-Queue: Yun Liu <yliuyliu@google.com> Cr-Commit-Position: refs/heads/master@{#62517}
-
Michael Starzinger authored
This adds a test checking whether function identity is preserved upon re-export of various function kinds. The tests are expected to all pass and just increase code coverage. R=ahaas@chromium.org TEST=mjsunit/wasm/export-identity Change-Id: I4fbb7db2d78c7ffeb6278d6b6d87a7c029326387 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687893Reviewed-by:
-
Andreas Haas authored
This is the combined second and third step of refactoring indirect function calls through tables with index > 0 to work without runtime calls. The first CL introduces the WasmIndirectFunctionTable heap object. For a table of type anyfunc within a WebAssembly instance, WasmIndirectFunctionTable stores the size, the signature id's, the call targets, and the reference parameters for that table. I used the names that are already used for the matching fields of the WasmInstanceObject. The second CL expands the IndirectFunctionTableEntry to work also on WasmIndirectFunctionTable objects. All changes to a function table go through this class. The third CL introduces uses of the WasmIndirectFunctionTable. In this CL I change the code generation in TurboFan to replace runime calls with direct accesses to the new WasmIndirectFunctionTable. Additionally I extended the initialization of WasmIndirectFunctionTable, and also implement Table.grow. R=mstarzinger@chromium.org Bug: v8:7581 Change-Id: Ic7615c0138562d27897683358ddc0943add1acfe Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1684186 Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by:
-
Ng Zhi An authored
Bug: v8:8460 Change-Id: I5d1ba9243d798dd4c988226a25ee61f6aa0f4e6f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1684518Reviewed-by:
-
Georg Schmid authored
TypeNarrowing and TypedOptimization can successively narrow range types of loop variables. In the presence of new, precise information on such loop variables, e.g. due to load elimination, many such narrowing steps are necessary, however, leading to very slow convergence of optimizations and an explosion in memory consumption. Until we have a sound way of speeding this process up, we disable TypedOptimization on loop-related Phi nodes. R=bmeurer@chromium.org, mvstanton@chromium.org Bug: chromium:978750 Change-Id: Ibce7db69807d2c1bc6a56c2f0287440bec0ce04b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687892 Commit-Queue: Georg Schmid <gsps@google.com> Commit-Queue: Michael Stanton <mvstanton@chromium.org> Reviewed-by:
-
Michael Starzinger authored
This assertion was borked, as it accepted obviously "same" values like the same object. This fixes the predicate by switching both assertSame and assertNotSame to use {Object.is} underneath. It also adds a new respective regression test (gotta test the tester). R=ahaas@chromium.org TEST=message/mjsunit/fail/assert_not_same Change-Id: I6ba20c4b8b96a736ab924715b1cad78f2f43a120 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687541Reviewed-by: -
Milad Farazmand authored
Extra parameters passed to a builtin function in AIX were undefined. Issue had to do with using LoadP instead of lwz to load this FieldMemOperand. Change-Id: Ia21b691c64bee2fec1b3f4ec24ca6518c5ae61d9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687767 Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com> Reviewed-by:
-
Clemens Hammacher authored
This flips the flag to enable wasm code gc by default. Note that chromium override this default, so it will need a separate CL. R=mstarzinger@chromium.org CC=hablich@chromium.org Bug: v8:8217 Change-Id: If638fbda423449ed576237745db284dc449fb467 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687674Reviewed-by:
-
