- 20 Nov, 2019 1 commit
-
-
Suraj Sharma authored
This is a reland of d46bd852 Original change's description: > [ic] Migrate Code-based handlers to use data driven handler. > > All usage of KeyedLoadIC_Slow, HasIC_Slow, StoreInArrayLiteralIC_Slow > and KeyedStoreIC_Slow now use data driven handlers > > Bug: v8:9779 > Change-Id: Idd888c5c10b462a5fe155ba0add36f95169bd76d > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1895988 > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> > Commit-Queue: Suraj Sharma <surshar@microsoft.com> > Cr-Commit-Position: refs/heads/master@{#64918} Bug: v8:9779 Change-Id: I8fb9359752d6b8e8211c37e15e8f1bf61dd6532a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1916684Reviewed-by: Joshua Litt <joshualitt@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> Commit-Queue: Suraj Sharma <surshar@microsoft.com> Cr-Commit-Position: refs/heads/master@{#65086}
-
- 12 Nov, 2019 2 commits
-
-
Joshua Litt authored
This reverts commit d46bd852. Reason for revert: I suspect this breaks the 'V8 Linux - predictable' bot. Specifically, 'typedarray-copywithin' has been failing since this landed. I am not exactly sure what is wrong from the tests error message, but see this link for more information: https://logs.chromium.org/logs/v8/buildbucket/cr-buildbucket.appspot.com/8896980452133814304/+/steps/Check_-_d8__flakes_/0/logs/typedarray-copywithin/0 Original change's description: > [ic] Migrate Code-based handlers to use data driven handler. > > All usage of KeyedLoadIC_Slow, HasIC_Slow, StoreInArrayLiteralIC_Slow > and KeyedStoreIC_Slow now use data driven handlers > > Bug: v8:9779 > Change-Id: Idd888c5c10b462a5fe155ba0add36f95169bd76d > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1895988 > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> > Commit-Queue: Suraj Sharma <surshar@microsoft.com> > Cr-Commit-Position: refs/heads/master@{#64918} TBR=rmcilroy@chromium.org,verwaest@chromium.org,surshar@microsoft.com Change-Id: Id7c2b553f85b46048bed2c633b8bd24098f67147 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:9779 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1912092Reviewed-by: Joshua Litt <joshualitt@chromium.org> Commit-Queue: Joshua Litt <joshualitt@chromium.org> Cr-Commit-Position: refs/heads/master@{#64922}
-
Suraj Sharma authored
All usage of KeyedLoadIC_Slow, HasIC_Slow, StoreInArrayLiteralIC_Slow and KeyedStoreIC_Slow now use data driven handlers Bug: v8:9779 Change-Id: Idd888c5c10b462a5fe155ba0add36f95169bd76d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1895988Reviewed-by: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> Commit-Queue: Suraj Sharma <surshar@microsoft.com> Cr-Commit-Position: refs/heads/master@{#64918}
-
- 10 Oct, 2019 1 commit
-
-
Suraj Sharma authored
Bug: v8:9779 Change-Id: Id0d7a214766f91ed8e65f3e24c08e987ba27aff8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1838923Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Suraj Sharma <surshar@microsoft.com> Cr-Commit-Position: refs/heads/master@{#64205}
-
- 10 Sep, 2019 2 commits
-
-
Leszek Swirski authored
Rather than duplicating code paths for in- and out-of-object stores, have one code path which checks whether it needs to load the property store (and change the storage location to the HeapNumber value for unboxed doubles). As a drive-by, change the representation dispatch into a switch, and inline the representation checks into that switch, to make explicit what checks for what and which paths transform the value. Also, TNodify some of the surrounding functions. Change-Id: Ia1bf698b4cec3ffce9aaa5732cda2e3be9efd8e8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1795345Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/master@{#63652}
-
Suraj Sharma authored
based on dicussion at docs.google.com/document/d/1UzCOai9H07fYcSaSqvF_H7BS2-sF5q91A4r9O1mRnHc/ Bug: v8:9305 Change-Id: I7464d4267b6465cc02bc27dffb602c8871d846f9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1696285 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#63640}
-
- 30 Aug, 2019 1 commit
-
-
Sathya Gunasekaran authored
This reverts commit f6e08f43. This patch doesn't allow thin/cons strings to be inlined as weak refs to them are not supported by the GC. Bug: v8:9616 Change-Id: I0407654bd9d20fe0182de4b8554e21ddbce8b28c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1774720 Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#63478}
-
- 22 Aug, 2019 2 commits
-
-
Bill Budge authored
This reverts commit 8ee507f1. Reason for revert: Speculative, to unblock the V8 roller https://ci.chromium.org/p/chromium/builders/try/linux-rel/173637 Original change's description: > [ic] Inline constant fields in IC > > Previously, the handler would load the constant field from the holder > everytime by using the descriptor index. Instead, this patch inlines > the constant field directly into the handler. > > Change-Id: Ia731811b135897033f4c5dc973031a30f25a64ed > Bug: v8:9616 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1688829 > Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org> > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Cr-Commit-Position: refs/heads/master@{#63332} TBR=gsathya@chromium.org,ishell@chromium.org,verwaest@chromium.org Change-Id: I36c5648c56f1d78447b7a45504cdebf593c020a1 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:9616 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1766148Reviewed-by: Bill Budge <bbudge@chromium.org> Commit-Queue: Bill Budge <bbudge@chromium.org> Cr-Commit-Position: refs/heads/master@{#63353}
-
Sathya Gunasekaran authored
Previously, the handler would load the constant field from the holder everytime by using the descriptor index. Instead, this patch inlines the constant field directly into the handler. Change-Id: Ia731811b135897033f4c5dc973031a30f25a64ed Bug: v8:9616 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1688829 Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#63332}
-
- 23 May, 2019 3 commits
-
-
Yang Guo authored
TBR=bmeurer@chromium.org,leszeks@chromium.org Bug: v8:9247 Change-Id: I8d14d0192ea8c705f8274e8e61a162531826edb6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1624220Reviewed-by: Yang Guo <yangguo@chromium.org> Reviewed-by: Hannes Payer <hpayer@chromium.org> Reviewed-by: Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/master@{#61769}
-
Clemens Hammacher authored
This CL was generated by an automatic clang AST rewriter using this matcher expression: callExpr( callee( cxxMethodDecl( hasName("operator->"), ofClass(isSameOrDerivedFrom("v8::internal::Object")) ) ), argumentCountIs(1) ) The "->" at the expression location was then rewritten to ".". R=jkummerow@chromium.org TBR=mstarzinger@chromium.org,verwaest@chromium.org,yangguo@chromium.org Bug: v8:9183, v8:3770 No-Try: true No-Tree-Checks: true Change-Id: I0a7ecabdeafe51d0cf427f5280af0c7cab96869e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1624209Reviewed-by: Clemens Hammacher <clemensh@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Yang Guo <yangguo@chromium.org> Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#61764}
-
Yang Guo authored
Bug: v8:9247 Change-Id: I0023200c54fa6499ae4e2cf5e4c89407cc35f187 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1624218Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Andreas Haas <ahaas@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Michael Stanton <mvstanton@chromium.org> Commit-Queue: Yang Guo <yangguo@chromium.org> Cr-Commit-Position: refs/heads/master@{#61762}
-
- 20 May, 2019 1 commit
-
-
Yang Guo authored
Code that is being moved primarily deal with layout of a JSObject, accessing properties and elements, and map transitions. NOTREECHECKS=true NOTRY=true Bug: v8:9247 Change-Id: Ibce5d5926ac4021c8d40c4dd109948775ce1da58 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1613994 Commit-Queue: Yang Guo <yangguo@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#61638}
-
- 27 Apr, 2019 1 commit
-
-
Jaroslav Sevcik authored
This enables constant field tracking unconditionally. TBR=jgruber@chromium.org Bug: v8:8361 Change-Id: I02f35827d860c3e0f18a3d55cb156c088d48bc94 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1585730 Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#61055}
-
- 09 Jan, 2019 1 commit
-
-
Jakob Kummerow authored
The incremental migration required several pairs of functionally equivalent macros. This patch consolidates everything onto the respective new version and drops the obsolete versions. Bug: v8:3770 Change-Id: I4fb05ff223e8250c83a13f46840810b0893f410b Reviewed-on: https://chromium-review.googlesource.com/c/1398223Reviewed-by: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Andreas Haas <ahaas@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#58659}
-
- 14 Dec, 2018 1 commit
-
-
Jakob Kummerow authored
AsyncGeneratorRequest, DataHandler, LoadHandler, StoreHandler Bug: v8:3770 Change-Id: I71198f9af116d2ca37bbe47131ae73b6ae643e01 Reviewed-on: https://chromium-review.googlesource.com/c/1377457 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/master@{#58259}
-
- 05 Nov, 2018 1 commit
-
-
Jakob Kummerow authored
and split Smi out of objects.h into smi.h. Bug: v8:3770, v8:5402 Change-Id: I5ff7461495d29c785a76c79aca2616816a29ab1e Reviewed-on: https://chromium-review.googlesource.com/c/1313035Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Hannes Payer <hpayer@chromium.org> Reviewed-by: Adam Klein <adamk@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Deepti Gandluri <gdeepti@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#57252}
-
- 30 Jul, 2018 1 commit
-
-
Jaroslav Sevcik authored
This CL introduces InstanceTypeChecker namespace with type checkers for types used by the optimizing compiler. The type checkers are global functions. Examples: bool InstanceTypeChecker::IsJSFunction(InstanceType); bool InstanceTypeChecker::IsAllocationSite(InstanceType); The CL also uses these type checkers in the HeapObject::IsXXXX() functions to ensure consistency. Bug: v8:7790 Change-Id: I7eb9e79ca28da02fd489201f532e566d0d13243a Reviewed-on: https://chromium-review.googlesource.com/1154529Reviewed-by: Georg Neis <neis@chromium.org> Reviewed-by: Michael Stanton <mvstanton@chromium.org> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#54782}
-
- 26 Jul, 2018 1 commit
-
-
Peter Marshall authored
Fixes: src/objects/arguments.h src/objects/arguments-inl.h src/objects/compilation-cache-inl.h src/objects/data-handler-inl.h src/objects/hash-table-inl.h Bug: v8:7754,v8:7490 Change-Id: Ic17d4c3477c7d2003b325497cb9082899a0bf3fc Reviewed-on: https://chromium-review.googlesource.com/1151312Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#54736}
-
- 23 Jul, 2018 1 commit
-
-
Stephan Herhut authored
This moves the static handle() helper function to handles-inl.h as it ultimately depends on handles-inl.h anyway. To make this possible, also move some other code to -inl.h files and split up some header files into a -inl.h part. Bug: v8:7490 Change-Id: I0f68e0728ba082b87ffa911aaf205d9b1523d2c9 Reviewed-on: https://chromium-review.googlesource.com/1146723Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Stephan Herhut <herhut@chromium.org> Cr-Commit-Position: refs/heads/master@{#54617}
-
- 29 May, 2018 1 commit
-
-
Sebastien Marchand authored
see crbug.com/841460 , we recently hit some build issues when using Goma + jumbo builds because of a conflict on the definition of CONST, v8 defines it in globals.h and including windows.h also defines it. It should be possible to fix this by adding a bunch of #undef CONST but it seems a little bit hacky and might not always work (this could only fix the problem temporary if the jumbo merge limit changes and cause some include files to get included in a different order). Renaming the v8 definition of CONST to kConst, this follows the style guide guidelines: "there is no reason to change old code to use constant-style names, unless the old names are actually causing a compile-time problem" (https://google.github.io/styleguide/cppguide.html#Enumerator_Names) I also had to turn the PropertyConstness enum into an enum class to avoid some conflicts (both PropertyConstness and VariableMode define kConst). Bug: chromium:841460 Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng Change-Id: I2b70b9095374e88a5ae364cc557b39f20a3ab60f Reviewed-on: https://chromium-review.googlesource.com/1064197Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Yang Guo <yangguo@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Sigurd Schneider <sigurds@chromium.org> Commit-Queue: Sébastien Marchand <sebmarchand@chromium.org> Cr-Commit-Position: refs/heads/master@{#53413}
-
- 18 Apr, 2018 1 commit
-
-
Marja Hölttä authored
This is also pre-work for in-place weak refs. BUG=v8:7308, v8:5988 Change-Id: Ie78b0c59695c1e6af9780fffb363c931e2ee34e2 Reviewed-on: https://chromium-review.googlesource.com/1013583 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#52658}
-
- 23 Mar, 2018 1 commit
-
-
Igor Sheludko authored
This eases transition handlers caching and avoids memory overhead of respective StoreHandler objects. In addition, it allows to use such transition handlers on runtime side to make Object.assign implementation a bit faster. Bug: v8:5988 Change-Id: Iba660a11d4b300cd5f80615fb7e2608e53da8fee Reviewed-on: https://chromium-review.googlesource.com/931701Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#52187}
-
- 14 Dec, 2017 2 commits
-
-
Igor Sheludko authored
This CL also adds support for "lookup on dictionary receivers" to store ICs. Bug: v8:7206, v8:5561 Change-Id: Icebbc2d52c71f5d25b43f2f2a8adf674e4ec2cbc Reviewed-on: https://chromium-review.googlesource.com/819232 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#50113}
-
Igor Sheludko authored
This CL also removes LoadICProtoArray* builtins which are no longer necessary. Bug: v8:7206, v8:5561 Change-Id: Ic5d9a3d4d21c4bd5e5e1cd110bd029ced157a000 Reviewed-on: https://chromium-review.googlesource.com/819252 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#50104}
-
- 06 Dec, 2017 1 commit
-
-
Igor Sheludko authored
They will eventually be used instead of Tuple3/FixedArray by the IC system. Bug: v8:5561, v8:7159 Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng Change-Id: I39faad1b2dc10ce7d42cb7477ea87b64d1e0b44c Reviewed-on: https://chromium-review.googlesource.com/806178 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#49908}
-
- 23 Nov, 2017 1 commit
-
-
Igor Sheludko authored
This simplifies handling of DescriptorArray objects in deserializer. Bug: v8:5799 Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng Change-Id: Ie4f9c6903afd8273d6320e6b0e0b05231db6cc00 Reviewed-on: https://chromium-review.googlesource.com/785676 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by: Yang Guo <yangguo@chromium.org> Cr-Commit-Position: refs/heads/master@{#49605}
-
- 07 Nov, 2017 3 commits
-
-
Toon Verwaest authored
Thanks Igor and Jakob for the hard work to migrate ICs to data-driven handlers! This is done as of this CL. Bug: v8:5561 Change-Id: Icf1ddf0065e3aa85ac7efe4b99f74821ce3c0ac2 Reviewed-on: https://chromium-review.googlesource.com/756842 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#49203}
-
Toon Verwaest authored
Bug: v8:5561 Change-Id: If3a44d1e40c81a764b776725c7b28ead653437b9 Reviewed-on: https://chromium-review.googlesource.com/756833 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#49193}
-
Toon Verwaest authored
Bug: v8:5561 Change-Id: Ieb44074280fa034b4f88e630e747211d73dedb6f Reviewed-on: https://chromium-review.googlesource.com/753374Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#49184}
-
- 06 Nov, 2017 1 commit
-
-
Toon Verwaest authored
Bug: v8:5561 Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng Change-Id: I47b7df39e80a66449a1ebe98e30052ced2ef2bd3 Reviewed-on: https://chromium-review.googlesource.com/753326Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Yang Guo <yangguo@chromium.org> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#49151}
-
- 03 Nov, 2017 1 commit
-
-
Benedikt Meurer authored
This extends the support in TurboFan and the ICs for OOB loads to also apply to typed arrays and receivers whose prototype chain is protected by the "no elements" protector (aka the Array protector). TurboFan will generate code to materialize undefined instead when it sees a load that has the OOB bit set and add an appropriate code dependency on the global protector. For typed arrays it doesn't even need to check the global protector since elements are never looked up in the prototype chain for typed arrays. In the simple micro-benchmark from the bug we go from testInBounds: 103 ms. testOutOfBounds: 289 ms. to testInBounds: 103 ms. testOutOfBounds: 102 ms. which fixes the 3x slowdown and thus addresses the performance cliff. In general it's still beneficial to make sure that you don't access out of bounds, especially once we introduce a bounds check elimination pass to TurboFan. This also seems to improve the jQuery benchmark on the Speedometer test suite by like 1-2% on average. And the SixSpeed rest benchmarks go from rest-es5: 25 ms. rest-es6: 23 ms. to rest-es5: 6 ms. rest-es6: 4 ms. so a solid 5.7x improvement there. Bug: v8:6936, v8:7014, v8:7027 Change-Id: Ie99699c69cc40057512e72fd40ae28107216c423 Reviewed-on: https://chromium-review.googlesource.com/750089 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#49095}
-
- 31 Oct, 2017 1 commit
-
-
Benedikt Meurer authored
This adds support to the KeyedLoadIC to ignore out of bounds accesses for Strings and return undefined instead. We add a dedicated bit to the Smi handler to encode the OOB state and have TurboFan generate appropriate code for that case as well. This is mostly useful when programs accidentially access past the length of a string, which was observed and fixed for example in Babel recently, see https://github.com/babel/babel/pull/6589 for details. The idea is to also extend this mechanism to Arrays and maybe other receivers, as reading beyond the length is also often used in jQuery and other popular libraries. Note that this is considered a mitigation for a performance cliff and not a general optimization of OOB accesses. These should still be avoided and handled properly instead. This seems to further improve the babel test on the web-tooling-benchmark by around 1%, because the OOB access no longer turns the otherwise MONOMORPHIC access into MEGAMORPHIC state. Bug: v8:6936, v8:7014 Change-Id: I9df03304e056d7001a65da8e9621119f8e9bb55b Reviewed-on: https://chromium-review.googlesource.com/744022 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Camillo Bruni <cbruni@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#49049}
-
- 30 Oct, 2017 1 commit
-
-
Benedikt Meurer authored
This is preparation for supporting OOB loads from strings, which requires the KeyedLoadIC to track this information. Bug: v8:6936, v8:7014 Change-Id: Ide132244ee523397dd418d21fe3377976f6633fd Reviewed-on: https://chromium-review.googlesource.com/743481Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#49026}
-
- 13 Oct, 2017 1 commit
-
-
Igor Sheludko authored
Bug: chromium:764219 Change-Id: Ic68111e49da508aba255b1c651a85b2b00e62947 Reviewed-on: https://chromium-review.googlesource.com/718108Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#48534}
-
- 12 Oct, 2017 1 commit
-
-
Igor Sheludko authored
Bug: chromium:764219 Change-Id: I99d1192c5c0f2b8bf47e0f193a0c4d9c00477466 Reviewed-on: https://chromium-review.googlesource.com/712454 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#48492}
-
- 28 Sep, 2017 1 commit
-
-
Toon Verwaest authored
Bug: Change-Id: I6894c097a994527b5e749527966c5de6c42d964b Reviewed-on: https://chromium-review.googlesource.com/668405 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#48195}
-
- 01 Sep, 2017 3 commits
-
-
Maya Lekova authored
This is a reland of a9f517e2 Original change's description: > [builtins] Port Proxy set trap to CSA > > Bug: v8:6560, v8:6557 > Change-Id: I329794607e8de324fc696652555aaaeafcf519ec > Reviewed-on: https://chromium-review.googlesource.com/625940 > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Commit-Queue: Maya Lekova <mslekova@google.com> > Cr-Commit-Position: refs/heads/master@{#47760} Bug: v8:6560, v8:6557 Change-Id: I1b32992eac6cc5583a44703eed901e4ad15f1947 Reviewed-on: https://chromium-review.googlesource.com/647447 Commit-Queue: Maya Lekova <mslekova@google.com> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#47772}
-
Benedikt Meurer authored
This reverts commit a9f517e2. Reason for revert: Makes array sort flaky? https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20debug/builds/17894/steps/OptimizeForSize%20%28flakes%29/logs/array-sort Original change's description: > [builtins] Port Proxy set trap to CSA > > Bug: v8:6560, v8:6557 > Change-Id: I329794607e8de324fc696652555aaaeafcf519ec > Reviewed-on: https://chromium-review.googlesource.com/625940 > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Commit-Queue: Maya Lekova <mslekova@google.com> > Cr-Commit-Position: refs/heads/master@{#47760} TBR=neis@chromium.org,franzih@chromium.org,ishell@chromium.org,bmeurer@chromium.org,mslekova@google.com Change-Id: Ibebf5e694945e59bd2808841108e6686af51efaf No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:6560, v8:6557 Reviewed-on: https://chromium-review.googlesource.com/646169Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#47764}
-
Maya Lekova authored
Bug: v8:6560, v8:6557 Change-Id: I329794607e8de324fc696652555aaaeafcf519ec Reviewed-on: https://chromium-review.googlesource.com/625940Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Maya Lekova <mslekova@google.com> Cr-Commit-Position: refs/heads/master@{#47760}
-