- 25 Oct, 2017 40 commits
-
-
Clemens Hammacher authored
This extends the WASM_EXEC_TEST to also execute the test in Liftoff (our new baseline compiler). Use WASM_COMPILED_EXEC_TEST to execute in both compilers, but not in the interpreter. R=titzer@chromium.org Bug: v8:6600 Change-Id: I0b76a5cff9af1b8c4aaec3cceb154ad29ca1b58e Reviewed-on: https://chromium-review.googlesource.com/733560 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
Ben Titzer <titzer@chromium.org> Cr-Commit-Position: refs/heads/master@{#48932}
-
Georg Neis authored
Current chrome stable has a high number of crashes due to bugs in this feature. These bugs are already fixed but the fixes are hard to merge back. Therefore we decided to disable the feature in stable. This CL is intended to be merged to stable and then reverted in tot. Bug: chromium:762020 Change-Id: Ibd5a08e3b303a204fb84a408271a1c0f97cc5b7b Reviewed-on: https://chromium-review.googlesource.com/738176Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#48931}
-
Benedikt Meurer authored
Have JSProxy and JSGlobalProxy use the properties or hash technology like we use for all other JSReceivers. Also unify and simplify the code dealing with these hashes. Bug: v8:6344, v8:6911 Change-Id: Ic995639c74211ba6f33acd73428b8c6d95bf7919 Reviewed-on: https://chromium-review.googlesource.com/737833Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Sathya Gunasekaran <gsathya@chromium.org> Reviewed-by:
-
Clemens Hammacher authored
We have an internal limit of 50000 local variables per wasm function. This limit is checked when decoding the function body. For asm.js, we skip function body validation, since by construction the code we generate is correct. This makes us fail unexpectedly when trying to (lazily) compile an asm.js function with more than 50000 locals. Hence, check this limit in the asm parser and bail out if it is exceeded. R=mstarzinger@chromium.org Bug: chromium:775710 Change-Id: I89d2069e133fb0f84947d477ae1ac5eda85571aa Reviewed-on: https://chromium-review.googlesource.com/732660Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#48929}
-
Michael Starzinger authored
This is a reland of eeaffa9f Original change's description: > [objects] Introduce {CodeDataContainer} object type. > > This introduces the {CodeDataContainer} as a container for all mutable > fields associated with a {Code} object. For now only the kind-specific > flags are moved, but more fields can/will be moved gradually. The goal > is to make all fields in the {Code} header be immutable eventually. > > R=jarin@chromium.org > BUG=v8:6792 > > Change-Id: I2eeba893afaba877fb6117e1f18371898c3a175e > Reviewed-on: https://chromium-review.googlesource.com/732987 > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> > Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> > Cr-Commit-Position: refs/heads/master@{#48902} Bug: v8:6792 Change-Id: I31a127df4bb8ee5fedb4d73755df4deae6e1d352 Reviewed-on: https://chromium-review.googlesource.com/738109Reviewed-by:
-
Leszek Swirski authored
Following up on adding n-ary nodes, this extends the parser to support n-ary comma operations, including support for n-ary arrow function parameters. Bug: v8:6964 Bug: chromium:777302 Change-Id: Iba9c93b9eaa5a0870815b4fa29e84aa9d0c511e2 Reviewed-on: https://chromium-review.googlesource.com/735156 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Marja Hölttä <marja@chromium.org> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#48927}
-
Igor Sheludko authored
... containing Tuple2 value instead of two properties. This CL reduces the number of property queries in FunctionToString to one and it is memory-neutral. Change-Id: Ia6fa267f3e5b6670013f1da3e03cd70bf24dd65a Reviewed-on: https://chromium-review.googlesource.com/730744Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#48926}
-
Sergiy Byelozyorov authored
R=machenbach@chromium.org Bug: chromium:777345 Change-Id: I54e8121ada8590d082bcb172668a82e00b5cf248 Reviewed-on: https://chromium-review.googlesource.com/737632 Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org> Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Reviewed-by:
Sergiy Byelozyorov <sergiyb@chromium.org> Cr-Commit-Position: refs/heads/master@{#48925}
-
Clemens Hammacher authored
A WasmCompilationUnit can now either compile the code in liftoff or with Turbofan. If liftoff compilation fails (because of unsupported instructions), we fall back to TF. This new pipeline is only enabled if the --liftoff flag is enabled. R=titzer@chromium.org Bug: v8:6600 Change-Id: I63669cfd8b7f0c89b08dcbd4d125d5ed44c7265b Reviewed-on: https://chromium-review.googlesource.com/733091 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
-
Michal Majewski authored
Bug: v8:6917 Change-Id: Ibc3c738ef807d37d8b76f440d9765c4d0405c021 Reviewed-on: https://chromium-review.googlesource.com/735421 Commit-Queue: Michał Majewski <majeski@google.com> Reviewed-by:
-
Ben L. Titzer authored
R=clemensh@chromium.org Bug: Change-Id: I0c92aa07e10dcd1e9d9fd34dcaf23885076721b0 Reviewed-on: https://chromium-review.googlesource.com/735724 Commit-Queue: Ben Titzer <titzer@chromium.org> Reviewed-by:
Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#48922}
-
Clemens Hammacher authored
There is no need to test each operation on each single memory location. R=titzer@chromium.org, binji@chromium.org Bug: v8:6994 Change-Id: Ib401fa1dd4db2e1b9c7ee0b48bb0c1cc9e3f9139 Reviewed-on: https://chromium-review.googlesource.com/735149 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
Ben Smith <binji@chromium.org> Cr-Commit-Position: refs/heads/master@{#48921}
-
Leszek Swirski authored
Expressions of the form a_0 + a_1 + a_2 + a_3 + ... + a_n seem to be reasonably common for cases such as building templates. However, parsing these expressions results in a n-deep expression tree: ... / + / \ + a_2 / \ a_0 a_1 Traversing this tree during compilation can cause a stack overflow when n is large. Instead, for left-associate operations such as add, we now build up an n-ary node in the parse tree, of the form n-ary + / | \ / | ... \ a_0 a_1 a_n The bytecode compiler can now iterate through the child expressions rather than recursing. This patch only supports arithmetic operations -- subsequent patches will enable the same optimization for logical tests and comma expressions. Bug: v8:6964 Bug: chromium:724961 Bug: chromium:731861 Bug: chromium:752081 Bug: chromium:771653 Bug: chromium:777302 Change-Id: Ie97e4ce42506fe62a7bc4ffbdaa90a9f698352cb Reviewed-on: https://chromium-review.googlesource.com/733120 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: -
Leszek Swirski authored
Use an upper limit search followed by a binary search in the expression depth test. As our maximum expression depths increase, a simple linear search wastes cycles. Bug: v8:6964 Change-Id: I0669e4090f6cc1628d1dec475b9bd8ff52be3f7d Reviewed-on: https://chromium-review.googlesource.com/735346 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
-
Jaroslav Sevcik authored
This reverts commit 37b4b2f1. Reason for revert: Likely breaking canary. Original change's description: > [turbofan] Prune control flow based on failed map checks and comparisons. > > This introduces unreachable state into load elimination. We mark state > as unreachable if we know statically that a map check would fail. > When processing effect phis, we disconnect unreachable state's > control from the effect phi's merge, and point it to RuntimeAbort. > The control input to the merge is then updated with Dead. Dead > code elimination prunes the merge, phis and effect phis. > > Bug: v8:6396 > Change-Id: I01874b576e548747a915c7b645b96ebaa6f6700d > Reviewed-on: https://chromium-review.googlesource.com/730754 > Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> > Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> > Cr-Commit-Position: refs/heads/master@{#48810} TBR=jarin@chromium.org,bmeurer@chromium.org # Not skipping CQ checks because original CL landed > 1 day ago. Bug: v8:6396, chromium:777843 Change-Id: I6fac6f86e138f33756e688ec30424cb940690dae Reviewed-on: https://chromium-review.googlesource.com/737829Reviewed-by:
-
Georgia Kouveli authored
Bug: v8:6644 Change-Id: I47482fa15fa89b1d9cd6c943e89dcc543596de5d Reviewed-on: https://chromium-review.googlesource.com/738093Reviewed-by:
-
Michal Majewski authored
This is a reland of a24c7c9a Original change's description: > Reuse arch/mode discovery in deopt fuzzer > > Bug: v8:6917 > Change-Id: I1b7169c8702c8649812b17579d38d64de676ed60 > Reviewed-on: https://chromium-review.googlesource.com/723420 > Commit-Queue: Michał Majewski <majeski@google.com> > Reviewed-by: Michael Achenbach <machenbach@chromium.org> > Cr-Commit-Position: refs/heads/master@{#48838} Bug: v8:6917 Change-Id: I03b2c288257d44c2df9d0fa6cf4750d1c5719d59 Reviewed-on: https://chromium-review.googlesource.com/735719 Commit-Queue: Michał Majewski <majeski@google.com> Reviewed-by:
-
jgruber authored
Bug: Change-Id: Ib05bf9abb43872c69102f839876a869c55f8ca48 Reviewed-on: https://chromium-review.googlesource.com/737798Reviewed-by:
Peter Marshall <petermarshall@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#48915}
-
Loo Rong Jie authored
Bug: v8:6996,v8:6443 Change-Id: If968750687a8a7c0d1d4c1991c64236ebed55a5b Reviewed-on: https://chromium-review.googlesource.com/737490Reviewed-by:
-
Michael Lippautz authored
This reverts commit e26cd874. Reason for revert: The issue has been fixed. See related bug for description and CLs. Original change's description: > [heap] Add TSAN suppression for lock-order inversion in Scavenger > > The Scavenger currently requires taking the lock for OLD->NEW processing > and can also take another lock for sweeping a different page. > > Since order of pages during scavenge and sweep is unstable this may > result in lock order inversion reports on TSAN when long-running > programms are only executed on a single thread. > > The report is a false positve, hence flag it as suppression until we > redesign this particular piece. > > No-try: true > Bug: v8:6923 > Change-Id: I82355be1c8d83ea61cc21152aeb10b58b1dc4b86 > Reviewed-on: https://chromium-review.googlesource.com/716261 > Reviewed-by: Ulan Degenbaev <ulan@chromium.org> > Commit-Queue: Michael Lippautz <mlippautz@chromium.org> > Cr-Commit-Position: refs/heads/master@{#48504} # Not skipping CQ checks because original CL landed > 1 day ago. Bug: v8:6923 Change-Id: I7711466c6e2175dcab8d64d6a642e458e1cde3f5 Reviewed-on: https://chromium-review.googlesource.com/738110Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Hannes Payer <hpayer@chromium.org> Reviewed-by:
-
Clemens Hammacher authored
We were already handling the case that a called import throws, but if it returned an error which is not convertible to a number, we failed with a CHECK error. This CL fixes this. R=titzer@chromium.org Bug: chromium:771970 Change-Id: I6c9983459109d49c43304610b696d49de986a250 Reviewed-on: https://chromium-review.googlesource.com/735354 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
-
Georg Neis authored
E.g. use TrueConstant() instead of BooleanConstant(true) and NullConstant() instead of HeapConstant(factory...null_value()). R=jkummerow@chromium.org Bug: Change-Id: I0588d71940d8baf289eb8f8e6c8d20aa717d57f6 Reviewed-on: https://chromium-review.googlesource.com/735681 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#48911}
-
Ulan Degenbaev authored
The IsWhite check in the write barrier uses word size memory operations. It should use 32-bit cell size operation instead. Bug: v8:6955 Change-Id: I5bbcd99dcd7e3d435f96022a745a6c80c83eb3b3 Reviewed-on: https://chromium-review.googlesource.com/735153Reviewed-by:
-
Andreas Haas authored
R=titzer@chromium.org Change-Id: I028ec3b2e511079b14454fe0c138715c52e492b9 Reviewed-on: https://chromium-review.googlesource.com/737790Reviewed-by:
-
Michael Lippautz authored
All use cases of the RecursiveMutex have been removed. Bug: v8:6923 Change-Id: I25aeee2447db185dbaacf96ab06a660834a408b7 Reviewed-on: https://chromium-review.googlesource.com/735345Reviewed-by:
-
Ben L. Titzer authored
Pending the outcome of the discussion on the GitHub issue: https://github.com/WebAssembly/design/issues/1138 R=clemensh@chromium.org,ahaas@chromium.org Bug: Change-Id: I54a218a93c24cb221b9f0195e2b1abbe6208d8e2 Reviewed-on: https://chromium-review.googlesource.com/735343Reviewed-by:
Andreas Haas <ahaas@chromium.org> Commit-Queue: Ben Titzer <titzer@chromium.org> Cr-Commit-Position: refs/heads/master@{#48907}
-
Clemens Hammacher authored
Now that https://crrev.com/c/728026 has landed, we can construct the constexpr RegLists using symbolic register names instead of hard-coding the register codes. R=titzer@chromium.org Bug: v8:6600 Change-Id: I21e46aeb5e8598a56f641341bcd7cf718fe4fbf9 Reviewed-on: https://chromium-review.googlesource.com/735548Reviewed-by:
-
Benedikt Meurer authored
This optimization was disabled because 32-bit builds didn't properly find certain integer keys in maps anymore. The reason was that the runtime wasn't using ComputeIntegerHash for the full Signed32 range, but only for the SignedSmall range. This change improves the ARES-6 Basic test by around 6-7% on the steady state. Bug: chromium:77459, v8:6410, v8:6354, v8:6278, v8:6344 Change-Id: Ifae64e6b23ca8acee4c792be299f64caf951242f Reviewed-on: https://chromium-review.googlesource.com/737871Reviewed-by:
-
Michael Achenbach authored
This reverts commit eeaffa9f. Reason for revert: Breaks msan compile (uninitialized value in snapshot): https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/builds/17824 Original change's description: > [objects] Introduce {CodeDataContainer} object type. > > This introduces the {CodeDataContainer} as a container for all mutable > fields associated with a {Code} object. For now only the kind-specific > flags are moved, but more fields can/will be moved gradually. The goal > is to make all fields in the {Code} header be immutable eventually. > > R=jarin@chromium.org > BUG=v8:6792 > > Change-Id: I2eeba893afaba877fb6117e1f18371898c3a175e > Reviewed-on: https://chromium-review.googlesource.com/732987 > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> > Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> > Cr-Commit-Position: refs/heads/master@{#48902} TBR=mstarzinger@chromium.org,jarin@chromium.org Change-Id: I74fe833b074752d640cff4aa4680f250e1bd8780 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:6792 Reviewed-on: https://chromium-review.googlesource.com/738029Reviewed-by:
-
Marja Hölttä authored
- Make it possible to store quarter-bytes instead of full bytes. - Don't store is_used; it can be recovered correctly based on the actual full parse (when a lazy function is eventually called) and has_forced_scope_allocation. - With the is_used change, the old testing approach (which compared a scope for which we didn't do scope allocation to the baseline) no longer made sense. Replaced it with a new testing approach, which is also closer to the actual usage. - First version (reverted): https://chromium-review.googlesource.com/725422 BUG=v8:5516 Change-Id: I1468af6670b689a104bd867377caa1d236070820 Reviewed-on: https://chromium-review.googlesource.com/733123Reviewed-by:
Adam Klein <adamk@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/master@{#48903}
-
Michael Starzinger authored
This introduces the {CodeDataContainer} as a container for all mutable fields associated with a {Code} object. For now only the kind-specific flags are moved, but more fields can/will be moved gradually. The goal is to make all fields in the {Code} header be immutable eventually. R=jarin@chromium.org BUG=v8:6792 Change-Id: I2eeba893afaba877fb6117e1f18371898c3a175e Reviewed-on: https://chromium-review.googlesource.com/732987Reviewed-by: -
Ulan Degenbaev authored
Body descriptors are used by marking and scavenging visitors. Change-Id: I6912bb5b924755db5750f0a3b1e4909bff5375c7 Reviewed-on: https://chromium-review.googlesource.com/732978Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
Daniel Clifford <danno@chromium.org> Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#48901}
-
Clemens Hammacher authored
Otherwise, the quiet NaN bit might flip already when loading the float/double from memory or storing it. This fixes another NaN bit flip which happened on a single bot only. R=titzer@chromium.org Bug: v8:6954 Change-Id: Ica9be71db9c5b505302686e9c0a4b1cae020a7e4 Reviewed-on: https://chromium-review.googlesource.com/735320Reviewed-by:
-
Michaël Zasso authored
We found this while trying to integrate V8 6.3 into Node.js. One of the tests started to crash on Windows. https: //github.com/nodejs/node/pull/16271#issuecomment-337790715 Bug: Change-Id: I82514ff7b9ca6a2b5c4489fe7388c4beda9931c9 Reviewed-on: https://chromium-review.googlesource.com/735400Reviewed-by:
-
Benedikt Meurer authored
Elements on typed arrays are never looked up in the prototype chain, so there's no point in depending on the prototype chain validity cells for keyed stores to typed arrays. You just risk going megamorphic for unrelated changes. Bug: v8:6999 Change-Id: Id831de42a2c9eadfd5317ee9b5dbfaa207f236fe Reviewed-on: https://chromium-review.googlesource.com/737789Reviewed-by:
-
Georg Neis authored
R=jkummerow@chromium.org Bug: v8:6791 Change-Id: I55c11c1328c92983286a8173795ce38f0b1e9e8e TBR: yangguo@chromium.org Reviewed-on: https://chromium-review.googlesource.com/735322Reviewed-by:
-
Georg Neis authored
Bug: v8:6791 Change-Id: Id34db2021c02b885be3f300648d5941362381d0b Reviewed-on: https://chromium-review.googlesource.com/735561 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
-
Jakob Kummerow authored
as opposed to waiting until state() is PREMONOMORPHIC like named Load/StoreICs do. Keyed ICs do not have PREMONOMORPHIC state. Bug: v8:6999 Change-Id: If37705d3301fb93a2fc2bf10fdeb255ff06fdb5e Reviewed-on: https://chromium-review.googlesource.com/737655 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
-
Alexey Kozyatinskiy authored
TBR=dgozman@chromium.org Bug: chromium:595206 Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel Change-Id: Ibd55b6b2e375f53b527168995d0e89bd7a8109e4 Reviewed-on: https://chromium-review.googlesource.com/737531 Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org> Reviewed-by:
Aleksey Kozyatinskiy <kozyatinskiy@chromium.org> Cr-Commit-Position: refs/heads/master@{#48894}
-
Jaroslav Sevcik authored
I am not committing the regression test from the bug because it takes ages to run, but I have locally verified that it passes now. Bug: chromium:776645 Change-Id: Ia7128d9fa3cf864b1c1b646802a973fe41d4c4ae Reviewed-on: https://chromium-review.googlesource.com/735484Reviewed-by:
-
