1. 26 Dec, 2018 1 commit
  2. 08 Dec, 2018 1 commit
  3. 07 Dec, 2018 3 commits
  4. 25 Nov, 2018 1 commit
  5. 24 Nov, 2018 1 commit
  6. 13 Nov, 2018 1 commit
  7. 12 Nov, 2018 1 commit
  8. 07 Nov, 2018 1 commit
  9. 31 Oct, 2018 1 commit
  10. 30 Oct, 2018 1 commit
  11. 25 Oct, 2018 1 commit
  12. 11 Oct, 2018 1 commit
  13. 04 Sep, 2018 1 commit
    • Mike Stanton's avatar
      [builtins] Enable Torque Array.prototype.splice · fd334b32
      Mike Stanton authored
      Before, splice was implemented with a C++ fast path and a
      comprehensive JavaScript version.
      
      This impl. is entirely in Torque with a fastpath for SMI,
      DOUBLE and OBJECT arrays, and a comprehensive slow path.
      The same level of "sparse" array support as given by the
      array.js implementation is included.
      
      This reland addresses several issues:
      
      * Removed "sparse" array support from splice.
      * Addressed ClusterFuzz issue 876443:
        The test and code that uses the fix is in this CL.
        The fix in isolation can be seen here:
        https://chromium-review.googlesource.com/c/v8/v8/+/1199403
      * Removed dead code in elements.cc
      
      BUG=chromium:876443, v8:8131, v8:1956, v8:7221
      
      Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
      Change-Id: I2d4a66c24ba1edabeca34e27e6ff8ee6136ed5f1
      Reviewed-on: https://chromium-review.googlesource.com/1201783
      Commit-Queue: Michael Stanton <mvstanton@chromium.org>
      Reviewed-by: 's avatarJakob Gruber <jgruber@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#55610}
      fd334b32
  14. 31 Aug, 2018 1 commit
  15. 23 Aug, 2018 1 commit
  16. 22 Aug, 2018 1 commit
    • Tobias Tebbi's avatar
      Revert "[builtins] Reland Array.prototype.splice() Torque implementation." · e99a1092
      Tobias Tebbi authored
      This reverts commit cdaaa311.
      
      Reason for revert: chromium:876445 chromium:876453 chromium:876443
      
      Original change's description:
      > [builtins] Reland Array.prototype.splice() Torque implementation.
      > 
      > Before, splice was implemented with a C++ fast path and a
      > comprehensive JavaScript version.
      > 
      > This impl. is entirely in Torque with a fastpath for SMI,
      > DOUBLE and OBJECT arrays, and a comprehensive slow path.
      > The same level of "sparse" array support as given by the
      > array.js implementation is included.
      > 
      > Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
      > Change-Id: Ia7334a30b401988309e9909cfa0069da0bb6fb9f
      > Reviewed-on: https://chromium-review.googlesource.com/1169466
      > Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
      > Reviewed-by: Jakob Gruber <jgruber@chromium.org>
      > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
      > Cr-Commit-Position: refs/heads/master@{#55263}
      
      TBR=mvstanton@chromium.org,jgruber@chromium.org,tebbi@chromium.org
      
      Change-Id: I5b750a98e671b7284474ffcabc6b4d37a9d1219e
      No-Presubmit: true
      No-Tree-Checks: true
      No-Try: true
      Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
      Reviewed-on: https://chromium-review.googlesource.com/1184741Reviewed-by: 's avatarTobias Tebbi <tebbi@chromium.org>
      Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#55289}
      e99a1092
  17. 21 Aug, 2018 1 commit
  18. 09 Aug, 2018 1 commit
  19. 08 Aug, 2018 1 commit
  20. 07 Aug, 2018 1 commit
  21. 03 Aug, 2018 1 commit
  22. 25 Jul, 2018 3 commits
  23. 23 Jul, 2018 1 commit
  24. 17 Jul, 2018 1 commit
  25. 11 Jul, 2018 1 commit
  26. 10 Jul, 2018 1 commit
  27. 03 Jul, 2018 1 commit
  28. 02 Jul, 2018 1 commit
  29. 23 Jun, 2018 1 commit
  30. 19 Jun, 2018 1 commit
  31. 24 May, 2018 2 commits
  32. 17 May, 2018 1 commit
  33. 16 May, 2018 1 commit
  34. 14 May, 2018 1 commit
    • Simon Zünd's avatar
      [array] Disable DCHECK in RemoveArrayHoles. · d25840c3
      Simon Zünd authored
      This CL disables a DCHECK in RemoveArrayHoles that was triggered for
      JSArrays that have read-only elements in the prototype chain.
      
      The DCHECK is not removed because it will be re-enabled later when
      the copying from the prototype chain (during sorting) will be done
      for JSArrays as well.
      
      R=cbruni@chromium.org
      
      Bug: chromium:840855
      Change-Id: Ia278bd2f060df094f477b4efbc3f5bdafd7ea7a8
      Reviewed-on: https://chromium-review.googlesource.com/1057588Reviewed-by: 's avatarCamillo Bruni <cbruni@chromium.org>
      Commit-Queue: Simon Zünd <szuend@google.com>
      Cr-Commit-Position: refs/heads/master@{#53159}
      d25840c3
  35. 09 May, 2018 1 commit