- 12 Jul, 2019 25 commits
-
-
Michael Achenbach authored
Bug: v8:9476 Change-Id: Id3660d40fe219ee0816ac8550ee8affd1be4b95b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1698399Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/master@{#62682}
-
Mike Stanton authored
The bytecode graph builder currently creates the tagged template if it hasn't yet been done. This CL moves that work to serialization time. Bug: v8:7790 Change-Id: I9571c5ad2f553584869056fb0cf501e03563d6f0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687670 Commit-Queue: Michael Stanton <mvstanton@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Reviewed-by:
Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/master@{#62681}
-
Andreas Haas authored
This reverts commit 9a9aa71f. Reason for revert: https://ci.chromium.org/p/v8/builders/ci/V8-Blink%20Linux%2064/33101 Original change's description: > [wasm] Compile JS to WASM wrappers asynchronously > > R=mstarzinger@chromium.org, ahaas@chromium.org > > Bug: v8:9231 > Change-Id: I9e18073bbe25bf8c9c5f9ace102316e6209d0459 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1669699 > Commit-Queue: Thibaud Michaud <thibaudm@chromium.org> > Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> > Reviewed-by: Andreas Haas <ahaas@chromium.org> > Cr-Commit-Position: refs/heads/master@{#62672} TBR=mstarzinger@chromium.org,ahaas@chromium.org,thibaudm@chromium.org Change-Id: I4c66663ca8a3f12f578c451f3c25705cebc753a7 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:9231 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1700066Reviewed-by:
Andreas Haas <ahaas@chromium.org> Commit-Queue: Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/master@{#62680}
-
Michael Achenbach authored
This reverts commit a10a1a65. Reason: Huge test time regression, see https://crbug.com/v8/9402. Bug: v8:9402 Change-Id: Ia71309d255ed8d9c3e96a90cc5bf6cb3ad77beaf Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1698400 Auto-Submit: Michael Achenbach <machenbach@chromium.org> Reviewed-by:
-
Santiago Aboy Solanes authored
Similar to https://chromium-review.googlesource.com/c/v8/v8/+/1697246 but for the Pointer case. The three CLs combined bring good improvements to the code generation, both in code size and then in runtime. Cq-Include-Trybots: luci.v8.try:v8_linux64_pointer_compression_rel_ng Cq-Include-Trybots: luci.v8.try:v8_linux64_arm64_pointer_compression_rel_ng Bug: v8:7703 Change-Id: I0903df55f3e19d3ee4dddb3c069ddc27b3265cd3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1698395Reviewed-by:
Sigurd Schneider <sigurds@chromium.org> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Cr-Commit-Position: refs/heads/master@{#62678}
-
Santiago Aboy Solanes authored
Similar to https://chromium-review.googlesource.com/c/v8/v8/+/1697246 but for the Any case. Cq-Include-Trybots: luci.v8.try:v8_linux64_pointer_compression_rel_ng Cq-Include-Trybots: luci.v8.try:v8_linux64_arm64_pointer_compression_rel_ng Bug: v8:7703 Change-Id: I99f839faad17da35adac8a084289b1553530d4a2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1698394Reviewed-by:
-
Santiago Aboy Solanes authored
In essence, it simplifies the pattern (in x64): movl register, ___ movlsxlq register, register into: movlsxlq register, ___ This makes the code smaller and run faster, without compromising. We can do something similar for Arm64 too. The cases for Pointer and Any seem to be trickier but there seems to be room to improve as well. Cq-Include-Trybots: luci.v8.try:v8_linux64_pointer_compression_rel_ng Cq-Include-Trybots: luci.v8.try:v8_linux64_arm64_pointer_compression_rel_ng Bug: v8:7703 Change-Id: I583bdfafdae9330be0a08ad1dd4c196e7de2f0d5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1697246Reviewed-by:
-
Mu Tao authored
This CL removes Assember::stop invoking's dead argument accordingly (https://chromium-review.googlesource.com/c/v8/v8/+/1692925). R=clemensh@chromium.org, xwafish@gmail.com Change-Id: I9f4d91f15e3bc9e56815a328326997a273e42fee Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1699841Reviewed-by:
Clemens Hammacher <clemensh@chromium.org> Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#62675}
-
Igor Sheludko authored
Bug: chromium:979401 Change-Id: I99ab2fd04bd2e23b4d7a494cecc056ec74cb9d04 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687422 Auto-Submit: Igor Sheludko <ishell@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#62674}
-
Ulan Degenbaev authored
The serializer clears JSFunctions together with feedback vectors assuming that there is one to one correspondence between them. That does not work in the case when there are multiple JSFunctions sharing the same feedback vector. This patch ensures that all such JSFunctions are properly cleared. Bug: v8:7857 Change-Id: Ie441089e12bda5a8be7f9bed90f7be9499938609 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1698383Reviewed-by:
Yang Guo <yangguo@chromium.org> Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#62673}
-
Thibaud Michaud authored
R=mstarzinger@chromium.org, ahaas@chromium.org Bug: v8:9231 Change-Id: I9e18073bbe25bf8c9c5f9ace102316e6209d0459 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1669699 Commit-Queue: Thibaud Michaud <thibaudm@chromium.org> Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Reviewed-by:
-
Sathya Gunasekaran authored
Bug: v8:9449 Change-Id: I7c50db92459df2a8a7da7b0bd2efdd2f3bed3e46 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1690952Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Reviewed-by:
-
Peter Marshall authored
Everyone was getting a copy of this through debug.h. Bug: v8:9396 Change-Id: I5189cb4bf27a3381768b0be479d7b3d60dec20bb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1695472 Commit-Queue: Peter Marshall <petermarshall@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
-
Sam Clegg authored
I noticed the indentation was off in one function, but also fixed all the other flake8 issues in this file. Change-Id: I2303ed87da7154484a872315f8355f57621514c4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1697054Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Commit-Queue: Sam Clegg <sbc@chromium.org> Cr-Commit-Position: refs/heads/master@{#62669}
-
Sathya Gunasekaran authored
Previously, we didn't have access checks for the megamorphic case cause we'd never get to this IC state for a receiver that doesn't hold the right private field. But now with lazy feedback allocation we share the megamorphic case code paths for the uninitialized loads as well, which exposes our bug. Bug: chromium:982702 Change-Id: I419406bcfc52575260a85d05520c1662735e15f8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1697256Reviewed-by:
Mythri Alle <mythria@chromium.org> Reviewed-by:
-
Darius Mercadier authored
This CL adds a new FreeList strategy, that can be turned on by using flag `--gc-freelist-strategy=1`. It is inspired by FreeListLegacy, and differs from it in the following ways: - Only has 3 categories: Medium, Large and Huge. - Any block that would have belong to tiniest, tiny or small in FreeListLegacy is considered wasted. - Allocation is done only in Huge, Medium and Large (in that order), using a first-fit strategy (only the first block of each freelist is ever considered though). - Performances is supposed to be better than FreeListLegacy, but memory usage should be higher (because fragmentation will probably be higher). Bug: v8:9329 Change-Id: Ib399196788f1dfaa1aeddc3dc721375dd7da65f1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1697248 Commit-Queue: Darius Mercadier <dmercadier@google.com> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#62667}
-
Michael Starzinger authored
R=clemensh@chromium.org BUG=v8:9429,v8:9396 Change-Id: I1d8b5b67e5cd1b1788e6c0dcb45762c555b6f0e0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1695471Reviewed-by:
-
Nico Hartmann authored
This change implements lowering of speculative BigInt addition as well as BigInt heap constants to corresponding int64 versions, if they are used in a context where the result is truncated to the least significant 64 bits (e.g. using asUintN). The JSHeapBroker is extended to provide access to the BigInt's least significant digit during concurrent compilation. The BigInt context (required to introduce correct conversions) is recognized in the RepresentationChanger by either the output type propagated downward or the TypeCheckKind propagated upward. This is necessary, because the TypeCheckKind may only be set by nodes that may potentially deopt (and sit in the effect chain). This is the case for SpeculativeBigIntAdd, but not for BigIntAsUintN. This CL contains a simple fix to prevent int64-lowered BigInts to flow into state values as the deoptimizer cannot handle them yet. A more sophisticated solution to allow the deoptimizer to materialize truncated BigInts will be added in a following CL. Bug: v8:9407 Change-Id: I96a293e9077962f53e5f199857644f004e3ae56e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1684183 Commit-Queue: Nico Hartmann <nicohartmann@google.com> Reviewed-by:
-
Georg Schmid authored
This CL adds the --assert-types flag to d8, which is intended to insert additional runtime checks after typed nodes, verifying the validity of our typing rules. So far, only range types are checked. Thanks to Neil Patil for suggesting something similar. R=neis@chromium.org, tebbi@chromium.org Change-Id: I5eb2c482235ec8cd07ee802ca7c12c86c2d3dc40 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1678372 Commit-Queue: Georg Schmid <gsps@google.com> Reviewed-by:
-
Frank Tang authored
https://chromium.googlesource.com/external/github.com/tc39/test262/+log/1ef21eb..6cb0a5 Bug: v8:7834 Change-Id: I809d7ddc0c579cf3fa8c9563d8f0ef59d4cc708b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1699302 Auto-Submit: Frank Tang <ftang@chromium.org> Reviewed-by:
-
Michael Achenbach authored
NOTRY=true Bug: chromium:813833,chromium:983128 Change-Id: I449796b761f53bb15a3563604d5a4a9018035cb6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1697255Reviewed-by:
Tamer Tas <tmrts@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/master@{#62662}
-
Andreas Haas authored
Even though this is not spec'ed yet, it's good to have an implementation so that we can use clusterfuzz on it. I changed the parameter order (hopefully) everywhere to (table_dst_index, table_src_index, ...). This corresponds to the (dst, src, ...) parameter order for the entry indices. R=binji@chromium.org Bug: v8:7581 chromium:980475 Change-Id: I2fb36ffd4bb2f2be5b22c8366732295fa6759236 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1698386Reviewed-by:
Ben Smith <binji@chromium.org> Commit-Queue: Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/master@{#62661}
-
Jon Kunkee authored
This change fixes missing symbol errors in the Windows 10 on ARM build of Node.js. When a whole class is marked for export, all of its members are marked as well. This can be a problem when inline members call undefined yet inline members of other classes: the exported function will contain a reference to the undefined inline function that should be satisfied at link time, but because the other function is inline no symbol will be produced that will satisfy that reference. Clang gets around this by masking inlined class members from export using /Fc:dllexportInlines-. This is why b0a2a567 worked. Node.js' Windows builds use MSVC and so do not have access to this flag. This results in unresolved symbols at link time. Bug: v8:9465 Change-Id: Ief9c7ab6ba35d22f995939eb62a64d6f1992ed85 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1696771Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#62660}
-
Yutaka Hirano authored
This is a reland of https://crrev.com/c/v8/v8/+/1692366. The original change was reverted because it broke some blink tests. This will be landed after suppressing them: https://crrev.com/c/chromium/src/+/1695541 Make native errors serializable. The implementation is mostly straightforward, but there is one exception: the stack property. Although the property is not specified, the spec for error cloning asks us to preserve the property if possible. This implementation serializes the property only when it is a string, and otherwise ignores it. Spec: https://github.com/whatwg/html/pull/4665 Intent-to-Ship: https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/f8JngIi8qYs Bug: chromium:970079, v8:9462 Change-Id: Ibf012754f30237f6b5acf119ef834e73727a230f Cq-Include-Trybots: luci.v8.try:v8_linux_blink_rel Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1695202 Auto-Submit: Yutaka Hirano <yhirano@chromium.org> Commit-Queue: Simon Zünd <szuend@chromium.org> Reviewed-by:
Simon Zünd <szuend@chromium.org> Cr-Commit-Position: refs/heads/master@{#62659}
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/40634f1..c989268 Rolling v8/buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/80b545b..95c72f3 Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/b79dda9..1abe66f Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/d3f6994..78dec04 Rolling v8/tools/luci-go: git_revision:25958d48e89e980e2a97daeddc977fb5e2e1fb8c..git_revision:7d11fd9e66407c49cb6c8546a2ae45ea993a240c Rolling v8/tools/luci-go: git_revision:25958d48e89e980e2a97daeddc977fb5e2e1fb8c..git_revision:7d11fd9e66407c49cb6c8546a2ae45ea993a240c Rolling v8/tools/luci-go: git_revision:25958d48e89e980e2a97daeddc977fb5e2e1fb8c..git_revision:7d11fd9e66407c49cb6c8546a2ae45ea993a240c TBR=machenbach@chromium.org,sergiyb@chromium.org,tmrts@chromium.org Change-Id: I014010e41a1fe31582ab5aa3abbb28b1f1be32f9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1698803Reviewed-by:
v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#62658}
-
- 11 Jul, 2019 15 commits
-
-
Ben Smith authored
The alignment should be 3 (i.e. 8 bytes), but was specified as 2 (i.e. 4 bytes). Bug: v8:9425 Change-Id: I0beb09df25fe0281ed604909e894afd804f5411e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1693836Reviewed-by:
-
Andreas Haas authored
Even though this is not spec'ed yet, it's good to have an implementation so that we can use clusterfuzz on it. R=binji@chromium.org Bug: v8:7581 Change-Id: I323625322e5240dc6ac224dce8a1f1f7f6070758 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1695478Reviewed-by:
-
Jakob Kummerow authored
Change-Id: Id474294a808f5c77321cd12ff5333eb6000b04fa Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1692933 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
-
Tobias Tebbi authored
This is a partial revert of https://chromium-review.googlesource.com/c/v8/v8/+/1675960 Bug: v8:9472 Change-Id: I57ffc8d90a57336197cbf6ee27ebf9d1c914ec73 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1697745 Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Tobias Tebbi <tebbi@chromium.org> Reviewed-by:
-
Mythri A authored
With lazy feedback allocation and bytecode flushing we need to call %PrepareFunctionForOptimize before we call %OptimizeFunctionOnNextCall/ %OptimizeOsr. This cl: 1. Adds an additional state in pending optimized table to check if the optimization was triggered manually. 2. Changes the compilation pipeline to delete the entry from pending optimized table only if the optimization was triggered through %OptimizeFunctionOnNextCall / %OptimizeOsr. 3. Adds a check to enforce %PrepareFunctionForOptimize was called. 4. Adds a new run-time flag to only check in the d8 test runner. We don't want this check enabled in other cases like clusterfuzz that doesn't ensure %PrepareFunctionForOptimize is called. Bug: v8:8394, v8:8801, v8:9183 Change-Id: I9ae2b2da812e313c746b6df0b2da864c2ed5de51 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1664810 Commit-Queue: Mythri Alle <mythria@chromium.org> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#62653}
-
Maciej Goszczycki authored
BasicMemoryChunk sits above the MemoryChunk in the chunk hierarchy and is responsible for storing the bare minimum data to identify a chunk of memory, without worrying about GC etc. This change also completes the MemoryChunk offset asserts, which were previously missing for few key properties. Bug: v8:7464 Change-Id: Id4c7716c4ed5722ceca3cbc66d668aed016c74b0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1688843 Commit-Queue: Maciej Goszczycki <goszczycki@google.com> Reviewed-by:
-
Jakob Kummerow authored
Change-Id: Id1c46ca22002c358155823e3caae18f0ed9c47f5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1691033 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
-
Peter Marshall authored
The simulator builds have bugs which cause invalid frame markers in some cases. Change-Id: I837732c6f5efe24821415a0ae0626578bbcc3a7e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1697253Reviewed-by:
-
Mythri A authored
GetOwnPropertyNameTryFast uses ENUMERABLE_STRINGS filter to trigger fast path in KeyAccumulator::GetKeys conditionally when all properties on the receiver are enumerable. It is not easy to verify if all properties are enumerable and the current check is incorrect in some cases. For ex: when we have non-enumerable properties when we have elements on the receiver. This cl removes this try_fast path from the builtin. This could impact performance. The long term fix for this would be to fix KeyAccumulator::GetKeys to use fast path for more cases. Bug: chromium:977870 Change-Id: Iecde730739c2c452ffa0d893d0d1b3612a45d1b2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1679499Reviewed-by:
Igor Sheludko <ishell@chromium.org> Commit-Queue: Mythri Alle <mythria@chromium.org> Cr-Commit-Position: refs/heads/master@{#62649}
-
Andreas Haas authored
R=mstarzinger@chromium.org Bug: v8:7581 Change-Id: I9db3d2e4b2e2a685f81b516da8e6737db01c1238 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1695470 Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by:
-
Maciej Goszczycki authored
These are ancient artefacts from when HeapObject was a pointer. Bug: v8:9396 Change-Id: I1782837aa5bd4b8393cd084321b90baa614a7373 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1691911Reviewed-by:
-
Michael Achenbach authored
In order to migrate the extra flags into the fuzzer and keep bisection stable, we need to use the same RNG state for each call to generating fuzz flags. Throughout one fuzzing session the same random-seed is used (https://crbug.com/983128) and we'll pass it to the fuzz config in a follow up. TBR=tmrts@chromium.org NOTRY=true Bug: chromium:813833 Change-Id: I3203c86028a5d283238e6ef739f82eccee1302b1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1697254 Commit-Queue: Michael Achenbach <machenbach@chromium.org> Reviewed-by:
-
Santiago Aboy Solanes authored
Reverse specialization of https://chromium-review.googlesource.com/c/v8/v8/+/1684075. Again, it skips over Tagged to save some instructions. Cq-Include-Trybots: luci.v8.try:v8_linux64_pointer_compression_rel_ng Cq-Include-Trybots: luci.v8.try:v8_linux64_arm64_pointer_compression_rel_ng Bug: v8:7703 Change-Id: I7fc50e0d8eebfef7a1ba02ce3d687ff808f30680 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1693007Reviewed-by:
-
Ben L. Titzer authored
In the atomics stress, the search for sequential sequences creates lots of new WebAssembly.Memory objects. This memory pressure is not central to this test, so reuse the same memory to make them less flaky. R=mstarzinger@chromium.org Change-Id: I8d135e7b82d572cb1df38f37a4e2f6393f6b2e05 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1697247Reviewed-by:
-
Andreas Haas authored
This removes an include that was added unnecessarily in https://crrev.com/c/1690960. R=clemensh@chromium.org Bug: v8:9396 Change-Id: I5cf7ae49b3a40b6665605af1db6b43b27aeb3a32 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1692927Reviewed-by:
-
