- 18 Oct, 2017 40 commits
-
-
Michael Lippautz authored
This reverts commit 6488c9e5. Reason for revert: wasm grow memory test fails; requires investigation. https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20shared/builds/20548/steps/Check/logs/grow-memory Original change's description: > [heap] ArrayBufferTracker: Only consider committed size > > - Only consider commited size of ABs. > - Compute freed memory from retained sizes byte length might be a > HeapNumber and thus prohibited from accessing (as it may be already > collected). > > CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_linux64_tsan_rel;master.tryserver.v8:v8_linux64_tsan_concurrent_marking_rel_ng;master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel;master.tryserver.chromium.android:android_optional_gpu_tests_rel > > Bug: chromium:775896 > Change-Id: Ia0bed66afac5e4d5ed58194950a55156e19cec72 > Reviewed-on: https://chromium-review.googlesource.com/725722 > Commit-Queue: Michael Lippautz <mlippautz@chromium.org> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org> > Cr-Commit-Position: refs/heads/master@{#48699} TBR=ulan@chromium.org,mlippautz@chromium.org Change-Id: I0f8b28b876b09f149ff330e532e57cf1871e3961 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: chromium:775896 Cq-Include-Trybots: master.tryserver.v8:v8_linux64_tsan_rel;master.tryserver.v8:v8_linux64_tsan_concurrent_marking_rel_ng;master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel;master.tryserver.chromium.android:android_optional_gpu_tests_rel Reviewed-on: https://chromium-review.googlesource.com/726440Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/master@{#48700}
-
Michael Lippautz authored
- Only consider commited size of ABs. - Compute freed memory from retained sizes byte length might be a HeapNumber and thus prohibited from accessing (as it may be already collected). CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_linux64_tsan_rel;master.tryserver.v8:v8_linux64_tsan_concurrent_marking_rel_ng;master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel;master.tryserver.chromium.android:android_optional_gpu_tests_rel Bug: chromium:775896 Change-Id: Ia0bed66afac5e4d5ed58194950a55156e19cec72 Reviewed-on: https://chromium-review.googlesource.com/725722 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#48699}
-
Camillo Bruni authored
Change-Id: I82782f170c48dbe3f853dc04ec7e07e3968583f3 Reviewed-on: https://chromium-review.googlesource.com/724183Reviewed-by:
Mathias Bynens <mathias@chromium.org> Commit-Queue: Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/master@{#48698}
-
Mike Stanton authored
Support inlining of Array.prototype.filter in TurboFan. (relanding with fix for chromium:766635, visible in the diff between patchsets 2 and 3) Bug: v8:1956,chromium:766635 Change-Id: Ia50be6770602513e3d91d17e2b2ca9d3b0e8b42a Reviewed-on: https://chromium-review.googlesource.com/721119 Commit-Queue: Michael Stanton <mvstanton@chromium.org> Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#48697}
-
Clemens Hammacher authored
This makes the function constexpr and implements it for arbitrary unsigned integer types (up to 64 bits, but this can be extended if needed). R=mstarzinger@chromium.org Bug: v8:6600, v8:6921 Change-Id: I86d427238fadd55abb5a27f31ed648d4b02fc358 Reviewed-on: https://chromium-review.googlesource.com/718457 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
-
Toon Verwaest authored
Bug: v8:6921 Change-Id: I370b1c3f8fbf3f5478ac7779205083e05710ea15 Reviewed-on: https://chromium-review.googlesource.com/726081 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#48695}
-
Clemens Hammacher authored
Since we don't support gcc 2.96-4.0 any more, we can generalize the V8_INFINITY macro to always use std::numeric_limits<double>::infinity(). This also makes value constexpr on all systems. R=tebbi@chromium.org Change-Id: Ifa97dd2ee6d2c1e179c45f60a82d1ea8481e0590 Reviewed-on: https://chromium-review.googlesource.com/725733Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#48694}
-
Ulan Degenbaev authored
These tests are currently failing on TSAN bot with OOM when running with the stress-incremental-marking flag. Bug: v8:6924 Change-Id: I50b9a7142b2e8759f4bc327516f8c06ce1779777 Reviewed-on: https://chromium-review.googlesource.com/723427 Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/master@{#48693}
-
Ross McIlroy authored
A followup CL will move feedback slot allocation to the bytecode generator, which means it won't be done for asm_wasm code and the function will have an incorrect vector spec. Since asm_wasm doesn't use a feedback vector, just prevent it from being allocated for this code. BUG=v8:6921 Change-Id: I65a06f60bd75b54e5ef0df323184aad841e26177 Reviewed-on: https://chromium-review.googlesource.com/725703Reviewed-by:
-
Clemens Hammacher authored
This reverts commit e737b4ce. Reason for revert: On windows, V8_INFINITY is not constexpr Original change's description: > [test] Avoid unnecessary std::vector allocations > > Instead of copying an array of fixed values into an std::vector for > each usage of the FOR_INPUTS macro, just iterate the constant data > directly. > This also makes the <type>_vector() functions return {constexpr Vector} > instead of {std::vector}. > > R=tebbi@chromium.org > > Change-Id: Ifc3e5509b2fbf5e383c967c2f46acf2b07f7b5b4 > Reviewed-on: https://chromium-review.googlesource.com/725427 > Reviewed-by: Tobias Tebbi <tebbi@chromium.org> > Commit-Queue: Clemens Hammacher <clemensh@chromium.org> > Cr-Commit-Position: refs/heads/master@{#48688} TBR=clemensh@chromium.org,tebbi@chromium.org Change-Id: Iccb52941d4efe71b49b41572c3d922a5d78bdfd2 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/725899Reviewed-by:
Clemens Hammacher <clemensh@chromium.org> Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#48691}
-
Mike Stanton authored
We didn't correctly maintain the effect chain between the load of the map and the load of the instance type from the map. Bug: v8:6929 Change-Id: I970709fe74483c5cdef3d0cea36bb9e1dc98b40e Reviewed-on: https://chromium-review.googlesource.com/725424Reviewed-by:
-
Andreas Haas authored
TurboFan expects the offset input of a Load or Store node to be a pointer-size input, i.e. an int32 input on 32-bit platforms, and int64 on 64-bit platforms. In WebAssembly we always provided 32-bit offset though, which caused problems when the high word of the register which contained the offset was not empty. With this CL we change the offset input to int64 on 64-bit platforms. In addition we also change the type of the memory_size_ node to int64, so that that we do not have to adjust the type of the memory size at every memory load. This CL will cause performance regressions but is necessary for correctness and to avoid crashes. R=titzer@chromium.org Bug: chromium:766666 Change-Id: I5301e108d05e125258d2a06d500c1b75e91697b8 Reviewed-on: https://chromium-review.googlesource.com/723379Reviewed-by:
Ben Titzer <titzer@chromium.org> Commit-Queue: Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/master@{#48689}
-
Clemens Hammacher authored
Instead of copying an array of fixed values into an std::vector for each usage of the FOR_INPUTS macro, just iterate the constant data directly. This also makes the <type>_vector() functions return {constexpr Vector} instead of {std::vector}. R=tebbi@chromium.org Change-Id: Ifc3e5509b2fbf5e383c967c2f46acf2b07f7b5b4 Reviewed-on: https://chromium-review.googlesource.com/725427Reviewed-by: -
Ulan Degenbaev authored
The test does not take into account that Turbofan can force completion of in-object slack tracking. Bug: Change-Id: Ic7404e8395858acaf707e65ca4b17e6b7f776594 Reviewed-on: https://chromium-review.googlesource.com/723464Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#48687}
-
Peter Marshall authored
kByteLengthOffset is actually at the start of the object, so to avoid confusion, put the accessor declarations in the same order as the actual fields. Change-Id: Ic92e597911235ccf126cf934151a0886e5d2a6f6 Reviewed-on: https://chromium-review.googlesource.com/725325Reviewed-by:
-
Martyn Capewell authored
Add a SlotAddress macro assembler function to abstract obtaining the address of an sp-relative double word slot. Then, merge some stack accesses in builtins, generally changing from push to claim and poke. Bug: v8:6644 Change-Id: Id7a9f6e276a038fbffd8e2bbaa21f51855f057f1 Reviewed-on: https://chromium-review.googlesource.com/723465 Commit-Queue: Martyn Capewell <martyn.capewell@arm.com> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#48685}
-
Michael Starzinger authored
Now that {DeoptimizationOutputData} does not exists anymore we can rename {DeoptimizationInputData} to just {DeoptimizationData}. R=jarin@chromium.org Change-Id: Ib67967539d33714cc15e5d5b6dde522a9ede64b2 Reviewed-on: https://chromium-review.googlesource.com/725349Reviewed-by:Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#48684}
-
Franziska Hinkelmann authored
Analog to other interceptors, intercept the DefineProperty call only after obtaining the property descriptor. This behavior allows us to mirror calls on a sandboxed object as it is needed in Node. See for example https://github.com/nodejs/node/pull/13265 Bug: Change-Id: I73b8f8908d13473939b37fb6727858d0bee6bda3 Reviewed-on: https://chromium-review.googlesource.com/725295Reviewed-by:
Andreas Haas <ahaas@chromium.org> Commit-Queue: Franziska Hinkelmann <franzih@chromium.org> Cr-Commit-Position: refs/heads/master@{#48683}
-
jgruber authored
A while ago, CharacterRange::AddCaseEquivalents used to operate on a single range (the `this` value) and add case equivalents for that to `ranges`. This was changed in a2baaaac to use `ranges` as a list of incoming operands instead. When we now determine that the current range does not have case equivalents, we need to `continue` instead of `return` to avoid skipping the remaining ranges in the list. Bug: v8:6940 Change-Id: I9face88a2ef8b9408f177e503f3399a25e688e06 Reviewed-on: https://chromium-review.googlesource.com/725430Reviewed-by:
Yang Guo <yangguo@chromium.org> Reviewed-by:
Marja Hölttä <marja@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#48682}
-
Peter Marshall authored
We never read this pointer, and it could cause crashes when the GC inspects it. Bug: v8:6956 Change-Id: Ib493c2f0418de3e89975fd1f5a7e86cc66868ec7 Reviewed-on: https://chromium-review.googlesource.com/725331Reviewed-by:
-
Michael Starzinger authored
This makes sure that the lowering of {JSCreate} operator during create lowering is only applied to operations where both target and new.target are known to be constructors. R=jarin@chromium.org TEST=mjsunit/regress/regress-crbug-768080 BUG=chromium:774780,chromium:768080 Change-Id: I55a582a3453bba7e14655b594b7714a3940eeaae Reviewed-on: https://chromium-review.googlesource.com/725332Reviewed-by: -
Jaroslav Sevcik authored
Bug: v8:5267 Change-Id: I52d208d3520ad9c06c7e33378e2308631c598e33 Reviewed-on: https://chromium-review.googlesource.com/725386Reviewed-by:
-
Michael Achenbach authored
NOTRY=true Bug: chromium:772816 Change-Id: Iff1f2aeb79ead4782fe8fffc2c32b6f406c31539 Reviewed-on: https://chromium-review.googlesource.com/725380Reviewed-by:
Sergiy Byelozyorov <sergiyb@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/master@{#48678}
-
Michael Starzinger authored
This allocates and populates potential exception handler tables before the underlying {Code} objects is allocated. It essentially makes the field holding said table immutable after allocation. R=verwaest@chromium.org BUG=v8:6792 Change-Id: I52ca374d40e3a72a4de022aca10faead6422db79 Reviewed-on: https://chromium-review.googlesource.com/723299Reviewed-by: -
Michal Majewski authored
Bug: v8:6917 Change-Id: I45a3a683388341d61989473ebd0b761a1ad8a9e3 Reviewed-on: https://chromium-review.googlesource.com/721659 Commit-Queue: Michał Majewski <majeski@google.com> Reviewed-by:
-
Clemens Hammacher authored
The interface will now only be called for reachable code, hence the check in the graph builder is not needed any more. We DCHECK instead. R=titzer@chromium.org Change-Id: I24ef96d62d6a5cda18d9efefcbd089d5f324f624 Reviewed-on: https://chromium-review.googlesource.com/716176Reviewed-by:
-
Mike Stanton authored
All effectful nodes should be wired into the effect chain. Bug: v8:6929 Change-Id: I8a0b4148bb65628657df8019434a33a85127e92a Reviewed-on: https://chromium-review.googlesource.com/723359Reviewed-by:
-
Jaroslav Sevcik authored
Bug: v8:6906 Change-Id: I8e9ef0fe6314cac34396c9690db993f09e67c806 Reviewed-on: https://chromium-review.googlesource.com/725343Reviewed-by:
-
Clemens Hammacher authored
They did not preserve the bit pattern of nans before. Now they do. Also, add some tests for these instructions. R=ahaas@chromium.org, rodolph.perfetta@arm.com Bug: v8:6947 Change-Id: I189720cd47e1768194567a41371fc9586b414c45 Reviewed-on: https://chromium-review.googlesource.com/722979 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
Rodolph Perfetta <rodolph.perfetta@arm.com> Reviewed-by:
-
Pierre Langlois authored
The DoubleToI stub is no longer called outside of TurboFan, and always in the same way: - The parameter is on top of the stack. - The stub is always called in a slow path. - It truncates. Therefore, we can simplify it to only support this case and remove dead code. On top of this, since the stub is always considered to be on a slow path for all backends, this patch takes the opportunity to remove the `skip_fastpath` optimisation. This would generate a stub which does not handle all inputs, assuming that the backend already handled some of the inputs in a fast path. Removing this allows the stub to have the same behaviour on all targets. On Arm, this patch reworks the stub a little. We could use ip instead of saving and restoring a register on the stack. Also, comments would mention that we assume the exponent to be greater than 31 when the it can be 30 or higher. As done for Arm64, let's check this at runtime in debug mode. On Arm64, we can also implement the stub without pushing and poping off the stack. It needs 2 general purpose and a double scratch registers which we have reserved already (ip0, ip1 and d30). This removes the need to check that the stack pointer is always 16-bytes aligned. Finally, this also fixes a potential bug on Arm64, in the `GetAllocatableRegisterThatIsNotOneOf` method which is now removed. We were picking an allocatable double register when we meant to pick a general one. Bug: v8:6644 Change-Id: I88d4597f377c9fc05432d5922a0d7129b6d19b47 Reviewed-on: https://chromium-review.googlesource.com/720963Reviewed-by:
-
Clemens Hammacher authored
This CL fixes all occurences that don't require special OWNER reviews, or can be reviewed by Michi. After this one, we should be able to reenable the readability/check cpplint check. R=mstarzinger@chromium.org Bug: v8:6837, v8:6921 Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng;master.tryserver.v8:v8_linux_noi18n_rel_ng Change-Id: Ic81d68d5534eaa795b7197fed5c41ed158361d62 Reviewed-on: https://chromium-review.googlesource.com/721120 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
-
Georgia Kouveli authored
Also updates TurboAssembler::DropArguments to simplify dropping the receiver and the arguments. Bug: v8:6644 Change-Id: Ief3b529ffc574c213816a533948c7b1f5d014bd7 Reviewed-on: https://chromium-review.googlesource.com/723466Reviewed-by:
-
Michael Lippautz authored
The test was reading from undefined stack addresses instead of creating a string filled with characters that look like a new space pointer. Bug: v8:6953 Change-Id: I2c0a9034076012746bd70325a4f21c63f4c264fa Reviewed-on: https://chromium-review.googlesource.com/725322Reviewed-by:
-
Leszek Swirski authored
Removes the interrupt check and runtime call to TryInstallOptimizedCode from the optimization marker checks (i.e. CompileLazy and InterpreterEntryTrampoline). Instead, we rely on the other interrupt sources (in particular stack checks at function entries and loop headers) to install optimized code for us. This will hopefully not cause regressions, as we have plenty of other interrupt checks, but it may delay optimized code execution for some function by one function call. Bug: v8:6933 Change-Id: Ieadfff7ae2078d2a84085294158ad9a706eb9c64 Reviewed-on: https://chromium-review.googlesource.com/723475Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/master@{#48667}
-
Jakob Gruber authored
This is a reland of 526c31d0 Original change's description: > Reland "[snapshot] Add BuiltinDeserializerAllocator" > > This is a reland of 2b9a6d89 > Original change's description: > > [snapshot] Add BuiltinDeserializerAllocator > > > > Encapsulates special reservation / allocation behavior for builtin > > deserialization. > > > > Bug: v8:6624 > > Change-Id: Ic784ed43b607c881b356c6e535c9dbe185e1d4cd > > Reviewed-on: https://chromium-review.googlesource.com/716229 > > Commit-Queue: Jakob Gruber <jgruber@chromium.org> > > Reviewed-by: Yang Guo <yangguo@chromium.org> > > Cr-Commit-Position: refs/heads/master@{#48638} > > TBR=yangguo@chromium.org > > Bug: v8:6624 > Change-Id: I07c49263b4ef128dfe9b97d364e9a279b343aa24 > Reviewed-on: https://chromium-review.googlesource.com/723520 > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > Commit-Queue: Jakob Gruber <jgruber@chromium.org> > Cr-Commit-Position: refs/heads/master@{#48647} TBR=yangguo@chromium.org Bug: v8:6624 Change-Id: I4186fcf89b9fce3433a02fc864346a300b90ffb5 Reviewed-on: https://chromium-review.googlesource.com/725439Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#48666}
-
Jaroslav Sevcik authored
Bug: chromium:774824 Change-Id: Id3d0af0bb55c0985393fe3b139308b6b706e7bc0 Reviewed-on: https://chromium-review.googlesource.com/725339Reviewed-by:
-
Jaroslav Sevcik authored
Change-Id: I76a792638b58f0bdc0a6a04c912d816ebf04718c Reviewed-on: https://chromium-review.googlesource.com/725320Reviewed-by:
-
Michael Achenbach authored
TBR=sergiyb@chromium.org NOTRY=true Bug: chromium:772816 Change-Id: I532e2c05360547686844f73c56d021abcbeb46bf Reviewed-on: https://chromium-review.googlesource.com/725280Reviewed-by:
-
Michael Achenbach authored
This reverts commit 4054cf27. Reason for revert: Just exposes existing issues. Original change's description: > Revert "[test] Fix win-asan symbolizer path" > > This reverts commit 135576ff. > > Reason for revert: V8 Win32 ASAN failures: https://build.chromium.org/p/client.v8/builders/V8%20Win32%20ASAN/builds/73 > > It appears these failures were lurking there already, but were hidden because of the bug this CL fixed. Opened https://crbug.com/v8/6953 about these issues. > > Original change's description: > > [test] Fix win-asan symbolizer path > > > > This makes the symbolizer path relative, as the absolute paths contain > > a drive letter + colon on windows. The colon is confused by the > > sanitizer as an option separator. > > > > The test driver changes the cwd to the V8 root dir in each > > invocation. > > > > Bug: chromium:726584 > > Change-Id: Icf4e5a55bba5dec8e59a3dfe3eccdf7224e65c33 > > Reviewed-on: https://chromium-review.googlesource.com/721124 > > Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org> > > Commit-Queue: Michael Achenbach <machenbach@chromium.org> > > Cr-Commit-Position: refs/heads/master@{#48652} > > TBR=glider@chromium.org,rnk@chromium.org,machenbach@chromium.org,sergiyb@chromium.org,etienneb@chromium.org > > Change-Id: Ic78527950f6a239a03658e042d7244c9781d05db > No-Presubmit: true > No-Tree-Checks: true > No-Try: true > Bug: chromium:726584 > Reviewed-on: https://chromium-review.googlesource.com/723825 > Reviewed-by: Eric Holk <eholk@chromium.org> > Commit-Queue: Eric Holk <eholk@chromium.org> > Cr-Commit-Position: refs/heads/master@{#48653} TBR=glider@chromium.org,rnk@chromium.org,machenbach@chromium.org,eholk@chromium.org,sergiyb@chromium.org,etienneb@chromium.org Change-Id: I8ea3b1d74ece09bed4758522f51cbee56a7792e1 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: chromium:726584 Reviewed-on: https://chromium-review.googlesource.com/725319Reviewed-by:
-
peterwmwong authored
Bug: v8:5049 Change-Id: Ia4f5729be64794e9080eb0e644b86cd5d8c88a11 Reviewed-on: https://chromium-review.googlesource.com/722168Reviewed-by:
-
