Skip to content

V
V8
Switch branch/tag
  1. 12 May, 2022 1 commit
  3. 03 May, 2022 1 commit
  5. 01 Sep, 2021 1 commit
  7. 06 Aug, 2021 1 commit
  9. 02 Aug, 2021 1 commit
  11. 27 Jul, 2021 1 commit
  13. 26 Jul, 2021 1 commit
  15. 16 Jul, 2021 1 commit
  17. 12 Jul, 2021 1 commit
  19. 01 Jul, 2021 1 commit
    • Jakob Kummerow's avatar
      [bigint] Fix Karatsuba intermediate result length · a4b573e5
      Jakob Kummerow authored 
      When adding up the results of the recursive steps, the Karatsuba
algorithm can temporarily have intermediate results that are one
bit bigger than the final result. This patch makes sure we handle
that case correctly.
Since that extra bit would always get subtracted again, the old
code would not have caused incorrect results or memory corruption,
but it did run into DCHECK-failures, and potentially could have
caused segfaults.

Bug: v8:11515, chromium:1223724
Change-Id: I3592835d01cc36def8f0a9bae625e9249864ef78
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2988758Reviewed-by: 's avatarThibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75509}
      a4b573e5
  21. 15 Jun, 2021 1 commit
  23. 27 Mar, 2020 1 commit
  25. 13 Jan, 2020 1 commit
  27. 12 Jul, 2019 1 commit
    • Nico Hartmann's avatar
      [turbofan] Push BigInt truncation over addition and heap constants · 99df710d
      Nico Hartmann authored 
      This change implements lowering of speculative BigInt addition as well as
BigInt heap constants to corresponding int64 versions, if they are used in
a context where the result is truncated to the least significant 64 bits
(e.g. using asUintN). The JSHeapBroker is extended to provide access to the
BigInt's least significant digit during concurrent compilation. The BigInt
context (required to introduce correct conversions) is recognized in the
RepresentationChanger by either the output type propagated downward or the
TypeCheckKind propagated upward. This is necessary, because the TypeCheckKind
may only be set by nodes that may potentially deopt (and sit in the effect
chain). This is the case for SpeculativeBigIntAdd, but not for BigIntAsUintN.

This CL contains a simple fix to prevent int64-lowered BigInts to flow into
state values as the deoptimizer cannot handle them yet. A more sophisticated
solution to allow the deoptimizer to materialize truncated BigInts will be
added in a following CL.

Bug: v8:9407
Change-Id: I96a293e9077962f53e5f199857644f004e3ae56e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1684183
Commit-Queue: Nico Hartmann <nicohartmann@google.com>
Reviewed-by: 's avatarGeorg Neis <neis@chromium.org>
Reviewed-by: 's avatarSigurd Schneider <sigurds@chromium.org>
Reviewed-by: 's avatarMaya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62665}
      99df710d
  29. 26 Jun, 2019 1 commit
  31. 25 Jun, 2019 2 commits
  33. 03 May, 2019 1 commit
  35. 28 Feb, 2019 1 commit
  37. 30 Nov, 2018 1 commit
  39. 16 Nov, 2018 1 commit
    • Georg Neis's avatar
      [bigint] Make competing read/write operations on bitfield atomic. · f28a7533
      Georg Neis authored 
      GC needs to be able to read a bigint's length while the main thread may
change the length and the sign (bigints are intentionally mutable as
long as they haven't escaped to user code). Since both values are stored
in the same bitfield, we need to make these accesses atomic.

Also change right-trimming to not insert a filler when the object is
in large object space (it makes no sense there).

Bug: v8:8440
Change-Id: I72a1b6f1eda54566d3cfad554dda1a98ddd61975
Reviewed-on: https://chromium-review.googlesource.com/c/1337737
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: 's avatarUlan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57576}
      f28a7533
  41. 08 Nov, 2018 1 commit
    • Jakob Kummerow's avatar
      [bigint] Fix harmless DCHECK failure · a6ab4e00
      Jakob Kummerow authored 
      Behavior in Release mode was correct; Debug mode triggered a DCHECK
failure that indicated an inefficiency: when a requested truncation
would be a no-op, we should return the original BigInt, rather than
creating a copy. In the special case of -2^(n-1), i.e. the smallest
negative n-bit integer, getting truncated to n bits, with n being a
multiple of kDigitBits, this shortcut was not taken.

Bug: v8:8426
Change-Id: I8e4595d9ac0dbef81aae06688f9a9636bd2d9cd9
Reviewed-on: https://chromium-review.googlesource.com/c/1325029Reviewed-by: 's avatarGeorg Neis <neis@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57369}
      a6ab4e00
  43. 01 Oct, 2018 1 commit
  45. 21 Sep, 2018 1 commit
    • Benedikt Meurer's avatar
      [cleanup] Remove obsolete runtime functions. · 74adec5b
      Benedikt Meurer authored 
      Remove %ToPrimitive, %ToPrimitive_Number, %SameValue and %SameValueZero,
as these runtime functions were only used from tests. For the %SameValue
we use Object.is() to test the internal algorithm (the actual one even),
and for %SameValueZero we use Set#has() - this was already the case for
most uses anyways.

Also drop %IsDate and %ValueOf, which didn't have uses at all.

Bug: v8:8015
Change-Id: Ice26d25e68aed4d5d8adac0547c56aedf9826b13
Reviewed-on: https://chromium-review.googlesource.com/1237677
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: 's avatarYang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56127}
      74adec5b
  47. 23 Jul, 2018 1 commit
  49. 19 Jul, 2018 1 commit
    • Sigurd Schneider's avatar
      Revert "[turbofan] Inline Number constructor in certain cases" · c7a9af61
      Sigurd Schneider authored 
      This reverts commit 9eca23e9.

Reason for revert: Clusterfuzz correctness issue

Original change's description:
> [turbofan] Inline Number constructor in certain cases
> 
> This CL adds inlining for the Number constructor if new.target is not
> present. The lowering is BigInt compatible, i.e. it converts BigInts to
> numbers.
> 
> Bug: v8:7904
> Change-Id: If03b9f872d82e50b6ded7709069181c33dc44e82
> Reviewed-on: https://chromium-review.googlesource.com/1118557
> Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#54454}

TBR=jarin@chromium.org,neis@chromium.org,sigurds@chromium.org,bmeurer@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:7904
Change-Id: Ie5fa6c1262b8acc33edb672a0124f4458fcded86
Reviewed-on: https://chromium-review.googlesource.com/1142777Reviewed-by: 's avatarSigurd Schneider <sigurds@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54544}
      c7a9af61
  51. 16 Jul, 2018 1 commit
  53. 15 Jun, 2018 1 commit
  55. 16 Apr, 2018 1 commit
  57. 15 Apr, 2018 1 commit
  59. 10 Mar, 2018 1 commit
  61. 06 Mar, 2018 1 commit
  63. 03 Mar, 2018 1 commit
  65. 01 Mar, 2018 1 commit
  67. 28 Feb, 2018 1 commit
  69. 23 Feb, 2018 2 commits
  71. 22 Feb, 2018 2 commits
  73. 19 Feb, 2018 1 commit