- 03 May, 2019 1 commit
-
-
Ross McIlroy authored
Bug: v8:8801, v8:8394 Change-Id: I6bb46ecafe1bd94adbf0409f13c9b2e558da0823 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1594558 Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Commit-Queue: Mythri Alle <mythria@chromium.org> Auto-Submit: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by: Mythri Alle <mythria@chromium.org> Cr-Commit-Position: refs/heads/master@{#61200}
-
- 01 Oct, 2018 1 commit
-
-
Mathias Bynens authored
It was shipped in Chrome 67. Bug: v8:6791, v8:8238 Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel;luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux_noi18n_rel_ng;master.tryserver.blink:linux_trusty_blink_rel Change-Id: I94d8f0aa18570452403a35dea270b18f155c970a Reviewed-on: https://chromium-review.googlesource.com/1253604Reviewed-by: Georg Neis <neis@chromium.org> Commit-Queue: Mathias Bynens <mathias@chromium.org> Cr-Commit-Position: refs/heads/master@{#56310}
-
- 23 Jul, 2018 1 commit
-
-
Sigurd Schneider authored
This is a reland of 9eca23e9 Adds a deopt continuation, which fixes JavaScript stack traces to contain the number constructor after inlining. Original change's description: > [turbofan] Inline Number constructor in certain cases > > This CL adds inlining for the Number constructor if new.target is not > present. The lowering is BigInt compatible, i.e. it converts BigInts to > numbers. > > Bug: v8:7904 > Change-Id: If03b9f872d82e50b6ded7709069181c33dc44e82 > Reviewed-on: https://chromium-review.googlesource.com/1118557 > Commit-Queue: Sigurd Schneider <sigurds@chromium.org> > Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> > Reviewed-by: Georg Neis <neis@chromium.org> > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> > Cr-Commit-Position: refs/heads/master@{#54454} Bug: v8:7904 Change-Id: Ic416e5ba81fa3a0f59ae4afa80df83c46a759487 Reviewed-on: https://chromium-review.googlesource.com/1146581 Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#54609}
-
- 19 Jul, 2018 1 commit
-
-
Sigurd Schneider authored
This reverts commit 9eca23e9. Reason for revert: Clusterfuzz correctness issue Original change's description: > [turbofan] Inline Number constructor in certain cases > > This CL adds inlining for the Number constructor if new.target is not > present. The lowering is BigInt compatible, i.e. it converts BigInts to > numbers. > > Bug: v8:7904 > Change-Id: If03b9f872d82e50b6ded7709069181c33dc44e82 > Reviewed-on: https://chromium-review.googlesource.com/1118557 > Commit-Queue: Sigurd Schneider <sigurds@chromium.org> > Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> > Reviewed-by: Georg Neis <neis@chromium.org> > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> > Cr-Commit-Position: refs/heads/master@{#54454} TBR=jarin@chromium.org,neis@chromium.org,sigurds@chromium.org,bmeurer@chromium.org # Not skipping CQ checks because original CL landed > 1 day ago. Bug: v8:7904 Change-Id: Ie5fa6c1262b8acc33edb672a0124f4458fcded86 Reviewed-on: https://chromium-review.googlesource.com/1142777Reviewed-by: Sigurd Schneider <sigurds@chromium.org> Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#54544}
-
- 16 Jul, 2018 1 commit
-
-
Sigurd Schneider authored
This CL adds inlining for the Number constructor if new.target is not present. The lowering is BigInt compatible, i.e. it converts BigInts to numbers. Bug: v8:7904 Change-Id: If03b9f872d82e50b6ded7709069181c33dc44e82 Reviewed-on: https://chromium-review.googlesource.com/1118557 Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#54454}
-
- 01 Dec, 2017 2 commits
-
-
Georg Neis authored
Bug: v8:6791 Change-Id: I1c57fc697dc143fec8bfd67db16c7bc4f840462d Reviewed-on: https://chromium-review.googlesource.com/800620 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#49777}
-
Georg Neis authored
It reflects the semantics of ToBoolean, so it must be adapted for bigints. Bug: v8:6791 Change-Id: I18931df21528463dacf5ad50fa8264b1c968c6b5 Reviewed-on: https://chromium-review.googlesource.com/799831Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#49776}
-
- 29 Nov, 2017 1 commit
-
-
Georg Neis authored
In the presence of bigints, this optimization is no longer valid. Bug: v8:6791 Change-Id: I996ac78f8ae4aef5494dd0089374d04c6db6e72f Reviewed-on: https://chromium-review.googlesource.com/796070Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#49725}
-
- 23 Nov, 2017 1 commit
-
-
Georg Neis authored
The typer's ToNumber (and thus ToInteger etc.) returns type None when the input type is BigInt, but we weren't quite ready for that in a few places. R=jarin@chromium.org Bug: v8:7121 Change-Id: Ib12c726338f1ec3dfb9ba5cf54b00cc8d1351a89 Reviewed-on: https://chromium-review.googlesource.com/785130 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#49604}
-
- 13 Jul, 2017 1 commit
-
-
Adam Klein authored
The tail call implementation is hidden behind the --harmony-tailcalls flag, which is off-by-default (and has been unstaged since February). It is known to be broken in a variety of cases, including clusterfuzz security issues (see sample Chromium issues below). To avoid letting the implementation bitrot further on trunk, this patch removes it. Bug: v8:4698, chromium:636914, chromium:724746 Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng;master.tryserver.v8:v8_linux_noi18n_rel_ng Change-Id: I9cb547101456a582374fdf7b1a3f044a9ef33e5c Reviewed-on: https://chromium-review.googlesource.com/569069 Commit-Queue: Adam Klein <adamk@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#46651}
-
- 26 Jan, 2017 1 commit
-
-
bmeurer authored
BUG=chromium:685634 R=ishell@chromium.org Review-Url: https://codereview.chromium.org/2658853002 Cr-Commit-Position: refs/heads/master@{#42713}
-
- 16 Jan, 2017 1 commit
-
-
bmeurer authored
BUG=chromium:679378 R=jarin@chromium.org Review-Url: https://codereview.chromium.org/2634953002 Cr-Commit-Position: refs/heads/master@{#42365}
-
- 02 Jan, 2017 1 commit
-
-
bmeurer authored
When Crankshaft compiles a keyed load to arguments, it disabled optimization unless the KEYED_LOAD_IC for the access was monomorphic. But that's too restrictive, since it will also disable optimization for this function when the access is on a path that was never executed so far. This was spotted in the Node.js core function EventEmitter.prototype.emit, which was no longer optimizable with Crankshaft using latest V8. R=jarin@chromium.org BUG=v8:5790 Review-Url: https://codereview.chromium.org/2607303002 Cr-Commit-Position: refs/heads/master@{#42005}
-