- 24 Aug, 2017 16 commits
-
-
Camillo Bruni authored
Several stack traces from crash reports in https://crbug.com/754490 have wrong magic signatures. Even though we're supposed to be failing in a V8_Fatal the signature doesn't show up on the stack trace. Change-Id: I35c8f27e36fd2a0ec474095a6cf5557a76fe7d26 Reviewed-on: https://chromium-review.googlesource.com/631878Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Commit-Queue: Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/master@{#47575}
-
Camillo Bruni authored
We can avoid the ToString conversion before doing the HasProperty check. This avoid a costly Smi to String conversion which is unecessary for the following lookups. For very large dictionary elements this is a significant slow down as we will no longer hit the GetNumberStringCache. Change-Id: I5a0eb13470ab3d3d8a87ee36d28ce7be5cbc2b2e Reviewed-on: https://chromium-review.googlesource.com/626056Reviewed-by:
Camillo Bruni <cbruni@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Commit-Queue: Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/master@{#47574}
-
jgruber authored
The v8_enable_fast_mksnapshot gn flag reduces time spent in mksnapshot on x64 debug builds from 19s to 6s by disabling far jump rewrites and register allocation verification. This flag should only be used locally for development. Bug: v8:6688 Change-Id: I02e8546a6a329b9cb377b95ab586d5857a3c6731 Reviewed-on: https://chromium-review.googlesource.com/632258Reviewed-by:
Yang Guo <yangguo@chromium.org> Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#47573}
-
Yuki Shiino authored
In case of LAP(lazy accessor pair), the function's creation context must be equal to the accessor holder's creation context, so this CL changes the current context to the accessor holder's creation context. Note that this is the second attempt after https://crrev.com/2770003002 The change from the previous attempt is to skip looking for the object's constructor if the object itself is a function. Also some of Blink's LAP-context-sensitive tests got updated at https://crrev.com/c/597990 and the rest of the tests will get temporarily disabled at https://crrev.com/c/605408 . TBR=verwaest@chromium.org Bug: v8:6156 Change-Id: I09709a90995d82a03996d0347e5a1d8425b5db9c Reviewed-on: https://chromium-review.googlesource.com/563152 Commit-Queue: Yuki Shiino <yukishiino@chromium.org> Reviewed-by:
-
Michael Starzinger authored
This further reduces the footprint of the deferred blocks used as part of our CSA-asserts by marking the {DebugAbort} calls as unreachable. This allows us to elide (un)spilling because re-entry into the normal instruction stream is removed. R=jgruber@chromium.org BUG=v8:6688 Change-Id: Ib00362fbe34427b3c8f8c8f5fcea0b83028f81b2 Reviewed-on: https://chromium-review.googlesource.com/632056Reviewed-by: -
Yang Guo authored
We no longer include hydrogen stubs in the snapshot. R=jgruber@chromium.org Change-Id: Id268b416ed839f55d297a1888444ef6323ec9dd9 Reviewed-on: https://chromium-review.googlesource.com/631956Reviewed-by:
-
Yang Guo authored
R=jgruber@chromium.org Change-Id: I07b748990f3e23cfedb0fd0cf8dce62f21a309bd Reviewed-on: https://chromium-review.googlesource.com/631722Reviewed-by:
-
Michael Starzinger authored
This introduces a {DebugAbort} machine-level operator as well as the corresponding {ArchDebugAbort} backend instruction. The goal of this is to speed up snapshot generation due to cheaper "CSA-asserts". R=jgruber@chromium.org BUG=v8:6688 Bug: v8:6688 Change-Id: If45f7da0652d4bb920c51ab7a7c41f9670434bbb Also-By: jgruber@chromium.org Reviewed-on: https://chromium-review.googlesource.com/628560Reviewed-by: -
Yang Guo authored
Bug: v8:6747 Change-Id: If4b9c1ccd23c3ef1ed5e173f0143d2cc85581154 Reviewed-on: https://chromium-review.googlesource.com/631678Reviewed-by:
-
Alexandre Talon authored
Since the AST graph builder is gone, no variable should be named osr_ast_id. This CL replaces it with osr_offset. It designates the offset of the bytecode where the OSRing was triggered. Bug: Change-Id: Ia53a83b09f917fcd0174da685a18edd3ee3aa01f Reviewed-on: https://chromium-review.googlesource.com/621008Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
-
Michael Lippautz authored
DEBUG builds pull in all sorts of instrumentation infrastructure that leads to larger heaps. The check for intial size is only useful for release builds. Bug: v8:6746 Change-Id: I5ab220d21167e69d7fb32c9db68045368c4ef178 R: ulan@chromium.org Reviewed-on: https://chromium-review.googlesource.com/631876Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/master@{#47565}
-
Michael Hablich authored
This reverts commit 8bbc2242. Reason for revert: On Canary 3195. Original change's description: > [heap] Enable concurrent marking for x86 and x64. > > This is an experiment and will be reverted after getting canary > coverage. > > Bug: chromium:694255 > Change-Id: I40388d8c6db0e46e2ce64e88aba04c5ac8822e94 > Reviewed-on: https://chromium-review.googlesource.com/625959 > Commit-Queue: Ulan Degenbaev <ulan@chromium.org> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Cr-Commit-Position: refs/heads/master@{#47541} TBR=ulan@chromium.org,mlippautz@chromium.org Change-Id: I642c1f778267a795bf1e1a6bba863552394ad1d4 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: chromium:694255 Reviewed-on: https://chromium-review.googlesource.com/631717Reviewed-by:
Michael Hablich <hablich@chromium.org> Commit-Queue: Michael Hablich <hablich@chromium.org> Cr-Commit-Position: refs/heads/master@{#47564}
-
Clemens Hammacher authored
The {WireBytesRef} constructor checks that {offset + length} does not overflow. Hence we need to check for illegal sizes before constructing the {WireBytesRef}. The {consume_bytes} function already does that, so remove the redundant hand-written checking. R=titzer@chromium.org Bug: chromium:752781 Change-Id: If3a2946a62fa38cc668695ed7186b9751a1f356f Reviewed-on: https://chromium-review.googlesource.com/605894 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:Ben Titzer <titzer@chromium.org> Cr-Commit-Position: refs/heads/master@{#47563}
-
v8-autoroll authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/337452a..a35cf9a Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/810d9d2..92387bc TBR=machenbach@chromium.org,hablich@chromium.org Change-Id: I55630210fe41f252dfaf6d1df91c8de98d4cd1df Reviewed-on: https://chromium-review.googlesource.com/630142Reviewed-by:
v8 autoroll <v8-autoroll@chromium.org> Commit-Queue: v8 autoroll <v8-autoroll@chromium.org> Cr-Commit-Position: refs/heads/master@{#47562}
-
Alexey Kozyatinskiy authored
API resolves functions to its .prototype property to make possible queries like queryObjects(Object), queryObjects(HTMLElement), e.t.c. R=dgozman@chromium.org Bug: v8:6732 Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel Change-Id: Ie8dc2288fa7e59c69f9b2647a9d5e35f0ac9215f Reviewed-on: https://chromium-review.googlesource.com/630244 Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org> Reviewed-by:
Dmitry Gozman <dgozman@chromium.org> Cr-Commit-Position: refs/heads/master@{#47561}
-
Mircea Trofin authored
Initialize the code table with a valid default (e.g. illegal builtin), otherwise we're invalidating assumptions when relocating. Bug: chromium:757217 Change-Id: I77890f1fe0e31534d9844d2e91694df1ec185110 Reviewed-on: https://chromium-review.googlesource.com/630097Reviewed-by:
Brad Nelson <bradnelson@chromium.org> Commit-Queue: Brad Nelson <bradnelson@chromium.org> Cr-Commit-Position: refs/heads/master@{#47560}
-
- 23 Aug, 2017 24 commits
-
-
Alexey Kozyatinskiy authored
- simplify prototype traversal. - use V8InspectorClient::isInspectableHeapObject since some embedders on JavaScript heap contains not inspectable objects, e.g. wrapper boilerplates in blink. - Runtime.queryObjects takes prototype object as argument for more flexibility. R=alph@chromium.org Bug: v8:6732 Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel Change-Id: I06f0d5c987150c80c3e9b05e7f6ad195985fc539 Reviewed-on: https://chromium-review.googlesource.com/627577 Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org> Reviewed-by:
-
Anisha Rohra authored
Port 10f73fac R=bjaideep@ca.ibm.com, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com BUG= LOG=N Change-Id: Ia5b50df98cb26bc332e3e2b114861740bae19d3d Reviewed-on: https://chromium-review.googlesource.com/629217Reviewed-by:
Junliang Yan <jyan@ca.ibm.com> Commit-Queue: Junliang Yan <jyan@ca.ibm.com> Cr-Commit-Position: refs/heads/master@{#47558}
-
Brad Nelson authored
BUG= R=ahaas@chromium.org,mstarzinger@chromium.org Change-Id: Ida7ac441722d778946b7ac92e8f6c7fe5ea15cdc Reviewed-on: https://chromium-review.googlesource.com/628821 Commit-Queue: Brad Nelson <bradnelson@chromium.org> Reviewed-by:
-
Jaideep Bajwa authored
The testcase was failing on BE, fix to use 32bit load before calling testbit. R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com Log=N Bug: Change-Id: I075666b47dd90b6341ba7b4031cd4be96e8c1bf9 Reviewed-on: https://chromium-review.googlesource.com/628659Reviewed-by:
-
Georg Neis authored
With the removal of Crankshaft, kNumber has become obsolete as BinaryOperationFeedback. Turbofan uses kNumberOrOddball. Bug: Change-Id: If577f5efcc81d7c08f43908f2764ff0ec6f8747c Reviewed-on: https://chromium-review.googlesource.com/628376Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Reviewed-by:
Mythri Alle <mythria@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#47555}
-
Adam Klein authored
BytecodeGenerator previously assumed that any UNALLOCATED variable must be a global object property, but that's incorrect for global lexical variables declared in a different script. This patch fixes the behavior by always falling back to the runtime to deal with deleting UNALLOCATED variables. This is sub-optimal, but should be correct, and it's unclear if speed is important for this case. Bug: v8:6733 Change-Id: I83c2a0b6e30e5e5f4c79bfe14ebf196529816c71 Reviewed-on: https://chromium-review.googlesource.com/627636Reviewed-by:
-
Adam Klein authored
V8 used to erroneously allow ForStatements to contain a function declaration, but that hasn't been true since we shipped the "--harmony-restrictive-declarations" flag 1.5 years ago. Bug: v8:4824 Change-Id: I893b45aed468017f89c0c5964df2091bea030327 Reviewed-on: https://chromium-review.googlesource.com/621871Reviewed-by:
Marja Hölttä <marja@chromium.org> Commit-Queue: Adam Klein <adamk@chromium.org> Cr-Commit-Position: refs/heads/master@{#47553}
-
Ulan Degenbaev authored
Bug: chromium:694255 Change-Id: Ic21368f68e103ee1278b4e975255c6941f23a2d0 Reviewed-on: https://chromium-review.googlesource.com/629058Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#47552}
-
Ulan Degenbaev authored
This enables concurrent marking for x86 and x64 on GYP builds. Bug: chromium:694255 Change-Id: I371b38e72ce0e8f7ad5b0eed4e29b223b9ed1cf4 Reviewed-on: https://chromium-review.googlesource.com/628836 Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
-
Michael Lippautz authored
Bug: Change-Id: I8db893ac46ad82e52ff2918336107d55600789a5 Reviewed-on: https://chromium-review.googlesource.com/628542Reviewed-by:
-
Jochen Eisinger authored
Embedders should implement them via the v8::TracingController interface and return a pointer to an instance of that interface from v8::Platform::GetTracingController BUG=v8:6511 R=fmeawad@chromium.org Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng Change-Id: If17b013c7ce4cf540a186767fd6e1b5e00e0dab2 Reviewed-on: https://chromium-review.googlesource.com/554770Reviewed-by:
-
Ulan Degenbaev authored
This fixed IncrementalMarkingStepMakesBigProgressWithLargeObjects and MapRetaining. Change-Id: I3a91684fa1f0635e94dc1883b105ce8d3381a7d2 Reviewed-on: https://chromium-review.googlesource.com/628416 Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
-
Marja Hölttä authored
Now that they contain more than just one member variable, this might make sense (and at least doesn't do any harm). BUG=v8:6092 Change-Id: Ibd150bedf542580f69946f62f8aca47bce945499 Reviewed-on: https://chromium-review.googlesource.com/623748 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by:
Adam Klein <adamk@chromium.org> Cr-Commit-Position: refs/heads/master@{#47547}
-
peterwmwong authored
- Convert S.p.includes builtin from CPP to TFJ - Fast paths S.p.includes(str) and S.p.includes(str, smi) - Add Runtime kStringIncludes - Add StringIncludesIndexOfAssembler (Generate is based on StringPrototypeIndexOf builtin) - S.p.includes and S.p.indexOf both use StringIncludesIndexOfAssembler Quick measurements show 3x improvement for S.p.includes(str). More about the measurements: https://gist.github.com/peterwmwong/7a2a96f3171a52f16ca8125a089f38e7 Bug: v8:6680 Change-Id: I79cb8dbe2b79e6df15aa734e128eee25c7e6aaf5 Reviewed-on: https://chromium-review.googlesource.com/620150Reviewed-by:
-
Jaroslav Sevcik authored
This change prevents constant folding of uninhabited RefenceEqual node because that could widen a type (from None type to the type of the boolean constant). Hopefully, this is a temporary workaround that will be replaced by a better dead code elimination. Bug: v8:6631 Change-Id: Ie25e7d710aaf1d37c9adba60f92438570843dd5d Reviewed-on: https://chromium-review.googlesource.com/627916Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#47545}
-
Mostyn Bramley-Moore authored
BUG=chromium:752428 Change-Id: I0d1f3a09ecd2ffb7bfd8120b212e88fd00008fc0 Reviewed-on: https://chromium-review.googlesource.com/608961Reviewed-by:
-
jgruber authored
Due to shortcuts we take on the RegExp.p[@@split] fast path (we don't allocate a new instance), we need to send sticky regexps to the slow path. The problem is a slight impedance mismatch between the spec and our fast-path implementation. Spec: Creates a new regexp instance `splitter` that is guaranteed to be sticky, uses `splitter.lastIndex` to advance the search range, advances by itself using AdvanceStringIndex if `splitter` did not match at the current position. Our fast path: Uses the given regexp instance and does not modify stickyness, uses last_match_info to advance search range, returns (and assumes no more matches) once RegExpExecInternal fails to match. This is fine if the given regexp is non-sticky, since 1. the value of lastIndex is ignored, and 2. non-sticky regexps match if a match is found anywhere in the string, not just exactly at the current lastIndex. Sticky regexps though are a problem. If no match is found exactly at the current position, @@split assumes no more matches and exits. In a follow-up, we could explore other options, such as allocating a new instance or saving/restoring flags and lastIndex. Bug: v8:6706 Change-Id: I6da2266df72b2f80f00c1ce3cd7c8655de91f680 Reviewed-on: https://chromium-review.googlesource.com/626065Reviewed-by:
-
Michael Starzinger authored
R=mlippautz@chromium.org BUG=v8:6409 Change-Id: I0cdba60385c8b481a3fd7b1b5c3b2ba1b0b8367b Reviewed-on: https://chromium-review.googlesource.com/628059Reviewed-by:
-
Ulan Degenbaev authored
This is an experiment and will be reverted after getting canary coverage. Bug: chromium:694255 Change-Id: I40388d8c6db0e46e2ce64e88aba04c5ac8822e94 Reviewed-on: https://chromium-review.googlesource.com/625959 Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
-
Georg Neis authored
This moves Module and other module-related classes and definitions out of src/objects{.h,-inl.h,.cc} into src/objects/module{.h,-inl.h,.cc}. Also moves the contents of src/objects/module-info.h there. R=marja@chromium.org Bug: v8:1569, v8:5402 Change-Id: I49064bb4a5c5a6f409274c287e06e8dda351d615 Reviewed-on: https://chromium-review.googlesource.com/626818 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by: -
Jaroslav Sevcik authored
Revert "Reland "[turbofan] Polymorphic inlining - try merge map check dispatch with function call dispatch."" This reverts commit 4cee9fbc. Reason for revert: Breaks on clusterfuzz. Original change's description: > Reland "[turbofan] Polymorphic inlining - try merge map check dispatch with function call dispatch." > > This reverts commit 57af6811. > > This adds the checkpoint between the call and the polymorphic load. > I thought that JSCall with constant target cannot cause eager deopt, > but Canary seems to disagree (http://crbug.com/718019). > > Bug: v8:5267,chromium:718019 > Change-Id: I552b850db6beb93e733b371ad0e7204513da1dc4 > Reviewed-on: https://chromium-review.googlesource.com/622867 > Reviewed-by: Tobias Tebbi <tebbi@chromium.org> > Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> > Cr-Commit-Position: refs/heads/master@{#47521} TBR=jarin@chromium.org,tebbi@chromium.org,bmeurer@chromium.org Change-Id: Ib333883fa27b79fcd766c33997cb0ce46547bb94 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:5267, chromium:718019 Reviewed-on: https://chromium-review.googlesource.com/628076Reviewed-by:
-
Peter Marshall authored
Bug: v8:6333 Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng Change-Id: I50d4357a7e7a0e8f2d04d5d34952cf524c012d5f Reviewed-on: https://chromium-review.googlesource.com/625740 Commit-Queue: Peter Marshall <petermarshall@chromium.org> Reviewed-by:
-
Georg Neis authored
The initialization code of all modules must have been run before running any module's main code. This should have been fixed quite a while ago as part of another CL but somehow wasn't. In the process of fixing it now, I'm also moving the initialization phase out of Evaluate into Instantiatiate. This corresponds more closely to the specification and avoids confusion. Bug: v8:1569 Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng Change-Id: I3ea5d6be0f5d371e6a4c641778c51762f1867dc8 Reviewed-on: https://chromium-review.googlesource.com/620653Reviewed-by:
-
jgruber authored
This folds the allocation of the JSRegExpResult (basically a JSArray) together with its elements fixed array. Bug: v8:6741 Change-Id: I027c4fce7169c1bd6a17637619fdf3890e3f7f24 Reviewed-on: https://chromium-review.googlesource.com/625877 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
-
