- 11 Dec, 2018 24 commits
-
-
Tobias Tebbi authored
Bug: chromium:913212 Change-Id: I6bc4bb313d17840cc778d9d8c2eb3c6f2cc024a1 Reviewed-on: https://chromium-review.googlesource.com/c/1371605Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#58162}
-
Caitlin Potter authored
This makes the deoptimizer happy, and is more consistent with other Torque JS functions. BUG=chromium:912504, v8:8021 R=tebbi@chromium.org, danno@chromium.org, mvstanton@chromium.org, gsathya@chromium.org Change-Id: I4c86db9549c367dfab7f76b49a0cf3c69d3ec50b Reviewed-on: https://chromium-review.googlesource.com/c/1366397 Commit-Queue: Caitlin Potter <caitp@igalia.com> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Reviewed-by:
Sathya Gunasekaran <gsathya@chromium.org> Reviewed-by:
Michael Stanton <mvstanton@chromium.org> Reviewed-by:
Daniel Clifford <danno@chromium.org> Cr-Commit-Position: refs/heads/master@{#58161}
-
Jaroslav Sevcik authored
We assert that loops always have effect phis because there must be a stack check in every loop. However, with generators, the stack check may end up outside of loop because the dispatch switch is built first (while the dispatch switch will also keep the loop backedge alive). The logic for creating effect phis is already in the code, so removing the dcheck should be fine. Bug: chromium:913232 Change-Id: Icf4df831e8b47350543c2b82a34bd3af98782a16 Reviewed-on: https://chromium-review.googlesource.com/c/1372065Reviewed-by:
-
Andreas Haas authored
These are some tests I thought were missing. I wrote another test which crashes because of missing safepoint maps. I will add it in a separate CL which includes also the implementation. R=herhut@chromium.org Bug: v8:7581 Change-Id: Ibcc3b9ddab0f95580eb31fe78c84a26186a74db5 Reviewed-on: https://chromium-review.googlesource.com/c/1370039Reviewed-by:
Stephan Herhut <herhut@chromium.org> Commit-Queue: Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/master@{#58159}
-
Ross McIlroy authored
This change makes the SFI to bytecode link pseudo-weak. The marking visitors check whether the bytecode is old, and if so, don't mark it and instead push the SFI onto a bytecode_flushing_candidates worklist. Once marking is complete, this list is walked, and for any of the candidates who's bytecode has not been marked (i.e., is only referenced by the shared function info), the bytecode is flushed and the SFI has the function data replaced with an UncompiledData (which overwrites the flushed bytecode array). Since we don't track JSFunctions, these can still think the underlying function is compiled, and so calling them will invoke InterpreterEntryTrampoline. As such, logic is added to InterpreterEntryTrampoline to detect flushed functions, and enter CompileLazy instead. BUG=v8:8395 Change-Id: I4afba79f814ca9a92dec45d59485935845a6669d Reviewed-on: https://chromium-review.googlesource.com/c/1348433 Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#58158}
-
Sigurd Schneider authored
This is a experiment to see how performance is impacted. If we tank too much, we can revert this change. Change-Id: I01be33f5dd78aee6a5beecdc62adbaa6c3850eb1 Bug: v8:8344 Reviewed-on: https://chromium-review.googlesource.com/c/1355279 Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#58157}
-
Clemens Hammacher authored
This was done via {managed_native_module()->get()}. Add a simple getter for that. R=ahaas@chromium.org Bug: v8:8562 Change-Id: I8e461a8e16b618abdb772098fad3a6b721d54902 Reviewed-on: https://chromium-review.googlesource.com/c/1371564Reviewed-by:Andreas Haas <ahaas@chromium.org> Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#58156}
-
Clemens Hammacher authored
Since implicit returns are gone, this environment is never being used. R=titzer@chromium.org Bug: v8:8423 Change-Id: I24d61a1316433fde6835fd608c3d308592721a5c Reviewed-on: https://chromium-review.googlesource.com/c/1371569 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
Ben Titzer <titzer@chromium.org> Cr-Commit-Position: refs/heads/master@{#58155}
-
Ross McIlroy authored
These functions have been marked V8_DEPRECATE_SOON for a long time, now all uses have been removed from Chrome, mark them as deprecated. BUG=v8:7287,v8:8238 Change-Id: I47b23588231ca510ec2475cb476e4134c05e162a Reviewed-on: https://chromium-review.googlesource.com/c/1356517Reviewed-by:
Yang Guo <yangguo@chromium.org> Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#58154}
-
Clemens Hammacher authored
In most places we already call them "branches", and the spec also only uses this name. Hence remove the remaining mentions of "break". R=titzer@chromium.org Bug: v8:8562 Change-Id: I64ac39324681b8214cd2e68315eb86a69d85cba8 Reviewed-on: https://chromium-review.googlesource.com/c/1371567Reviewed-by:
-
Sven Sauleau authored
Uses the JavaScript BigInt Object to represent Wasm's 64bits integers. Attention, 32 bits architectures are not supported yet. Bug: v8:7741 Change-Id: I28b718fa567bca5103b2f38a879049cd20a46f12 Reviewed-on: https://chromium-review.googlesource.com/c/1355144 Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by:
Adam Klein <adamk@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#58152}
-
Clemens Hammacher authored
Instead, return directly when branching to the outermost block. When falling through the end of the function block, generate a standard return, otherwise do not generate a return at the end of the function block. R=titzer@chromium.org Bug: v8:8423 Change-Id: I3c5ffacfa4ef7a960d41bea62920bd98e63d78df Reviewed-on: https://chromium-review.googlesource.com/c/1369958 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
-
Clemens Hammacher authored
We hit a DCHECK in the wasm graph builder because the current SSA environment is unreachable. We were using the wrong block (the target block) to do the reachability check. R=titzer@chromium.org Bug: chromium:913804 Change-Id: I4cfd3a0c696fb63903a47e4448362626a524340d Reviewed-on: https://chromium-review.googlesource.com/c/1371566Reviewed-by:
-
Ben L. Titzer authored
This is purely a renaming change. The ES spec uses the term 'detach' for the process of removing the backing store of a typed array, while V8 uses the historical term 'neuter'. Update our internal implementation, including method names and flag names, to match the spec. Note that some error messages still use the term 'neuter' since error messages are asserted by some embedder tests, like layout tests. R=bmeurer@chromium.org, yangguo@chromium.org, mstarzinger@chromium.org, mlippautz@chromium.org BUG=chromium:913887 Change-Id: I62f1c3ac9ae67ba01d612a5221afa3d92deae272 Reviewed-on: https://chromium-review.googlesource.com/c/1370036 Commit-Queue: Ben Titzer <titzer@chromium.org> Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/master@{#58149}
-
Ross McIlroy authored
Update is_compiled() and has_feedback_vector() to return false in the case where the SFI's bytecode has been flushed, but the JSFunction hasn't yet been reset to uncompiled. Also add code to reset the JSFunction when it is recompiled lazily. BUG=v8:8394 Change-Id: I7c5f79066603ac1ae097a0a62c625b1a8e39431c Reviewed-on: https://chromium-review.googlesource.com/c/1363138Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#58148}
-
Benedikt Meurer authored
The typing of SpeculativeSafeIntegerSubtract didn't include -0, and the SimplifiedLowering rules for SpeculativeSafeIntegerSubtract didn't properly handle the case of `-0 - 0`, but would always pass Word32 truncations. Bug: chromium:913296 Change-Id: I0e5a401f075db8b349a5579e1e294df97378ea49 Reviewed-on: https://chromium-review.googlesource.com/c/1370042Reviewed-by:
-
Tobias Tebbi authored
Temporary additional verbosity to investigate crashes. This change has a small runtime overhead to remember the input types of NumberAdd. It should be reverted once chromiun:906567 is resolved. Bug: chromiun:906567 Change-Id: If86124d4dd96bc3c3266cd019119906a18b8558d Reviewed-on: https://chromium-review.googlesource.com/c/1369946Reviewed-by:
Sigurd Schneider <sigurds@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#58146}
-
Jakob Gruber authored
This: - documents removal of Code's stub key field. - removes SerializedCodeData's CodeStubKeys field. - removes masm's custom self-reference marker mechanism. Bug: v8:7777 Change-Id: Ie5c51bc895e508acdeb3994cf5558a2cf4c21540 Reviewed-on: https://chromium-review.googlesource.com/c/1367744 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
-
Michael Achenbach authored
When using correctness fuzzing, this makes sure all non-object arguments to typed array constructors are bound by 1MiB when interpreted as numbers. NOTRY=true Bug: chromium:910962 Change-Id: I66e87ece27aae7c5fa88429c5d1f1f478de702ae Reviewed-on: https://chromium-review.googlesource.com/c/1369959 Commit-Queue: Michael Achenbach <machenbach@chromium.org> Reviewed-by:
Mathias Bynens <mathias@chromium.org> Reviewed-by:
Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#58144}
-
Clemens Hammacher authored
The class declaration regexp in cpplint did not catch classes decorated by V8_EXPORT, V8_EXPORT_PRIVATE or any other decorator containing digits. This will be fixed in https://github.com/google/styleguide/pull/422. This CL already prepares the code base by fixing all errors that will be found after that change. Some follow-up changes were needed to fix implicit conversion that are not taken any more now. R=mstarzinger@chromium.org Bug: v8:8562 Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng Change-Id: I03713bd04dbc3f54b89a6c857a93463139aa5efd Reviewed-on: https://chromium-review.googlesource.com/c/1367751Reviewed-by:
-
Clemens Hammacher authored
This callback is not being used by now, so we can just change it without the deprecation dance. Instead of the WasmModuleObject, it now receives the new CompiledWasmModule wrapper which contains a shared pointer to the NativeModule. This is all that's needed for serialization. Some classes are pulled out of WasmModuleObject to allow reuse. R=adamk@chromium.org, mstarzinger@chromium.org CC=bbudge@chromium.org Bug: chromium:912031 Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng Change-Id: Icedb64efa92e66bec45cf8742942a07ae22f59c8 Reviewed-on: https://chromium-review.googlesource.com/c/1363140Reviewed-by:
Bill Budge <bbudge@chromium.org> Reviewed-by:
-
Stephen Martinis authored
This was deleted source side in https://crrev.com/c/1308912 with seemingly no ill effects. Bug: chromium:718157 Change-Id: Ic2516b391b76a8fb72df97f6f090af3c24f35766 Reviewed-on: https://chromium-review.googlesource.com/c/1371035Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/master@{#58141}
-
Yang Guo authored
We no longer implement part of the debugger in JS. Therefore we can remove the infrastructure to support this in the bootstrapper. Also includes some drive-by cleanups. Bug: v8:5530 R=petermarshall@chromium.org Change-Id: I06628a559c17f99c70029fcc94848b0c78f1d3e9 Reviewed-on: https://chromium-review.googlesource.com/c/1369945 Commit-Queue: Yang Guo <yangguo@chromium.org> Reviewed-by:
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/6fd29b2..510ff4c Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/e09a3df..74c92bb Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/03ee2d6..fed2cb3 TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org Change-Id: I71575232dba9e58d428e7d832537b550e082b9eb Reviewed-on: https://chromium-review.googlesource.com/c/1370692Reviewed-by:
v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#58139}
-
- 10 Dec, 2018 16 commits
-
-
Sven Sauleau authored
Fix and re-enable tests for WebAssembly's memory/constructor and table/constructor js-api. It introduces the '[EnforceRange] unsigned long' algorithm used to validate initial and maximum properties. The initial property is now required, by the switch to the Web IDL specification. Most of the input validations errors are now considered TypeError instead of RangeError. The WasmTableObject and WasmMemoryObject APIs use more consistently uint32_t to ensure integer range and remove the need for bounds checks. Cq-Include-Trybots: luci.chromium.try:linux-blink-rel Bug: v8:8319 Change-Id: Iedd3ee6484ef688a5e96f93006eb6ca66d805a48 Reviewed-on: https://chromium-review.googlesource.com/c/1354043 Commit-Queue: Adam Klein <adamk@chromium.org> Reviewed-by:
Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#58138}
-
Ben Smith authored
This implementation currently only supports the optimized tier. Bug: v8:7747 Change-Id: Ia1af29b11a5d3e8a48b122f6cf3240c9f5948bfb Reviewed-on: https://chromium-review.googlesource.com/c/1364710Reviewed-by:
-
Igor Sheludko authored
because RelocInfo does not need host Code object for updating pointers to heap objects embedded into code. This CL also simplifies typed slot iteration callback signature. Bug: v8:8518, v8:8262 Change-Id: I59fe9e3b4e9b69e3d87b5449c80bed14e311516f Reviewed-on: https://chromium-review.googlesource.com/c/1370037Reviewed-by:
-
Michael Starzinger authored
R=ahaas@chromium.org Change-Id: Ie8407bb05dc0a1aeda4066f29e239e9ee085d946 Reviewed-on: https://chromium-review.googlesource.com/c/1369955 Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by:
-
Michael Achenbach authored
TBR=sergiyb@chromium.org NOTRY=true Bug: v8:7783 Change-Id: I96a42759b8e1eecb74fdce5d8c43a6d93b6af0d6 Reviewed-on: https://chromium-review.googlesource.com/c/1370038Reviewed-by:
-
Maya Lekova authored
This is the longest running test on arm64, possibly contributing to a timeout: https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Linux%20-%20arm64%20-%20sim%20-%20debug/13906 Temporarily disabling it until there's a better solution for arm64 timeouts. Bug: v8:7783 Change-Id: Ia5755c7d0e09a64e607345a3a3185a6e86832939 R=leszeks@chromium.org NOTRY=true Change-Id: Ia5755c7d0e09a64e607345a3a3185a6e86832939 Reviewed-on: https://chromium-review.googlesource.com/c/1369956Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Commit-Queue: Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/master@{#58133}
-
Clemens Hammacher authored
Just pass a pointer to the current stack. This makes it easier to reuse the {DoReturn} method for breaks to the outermost block. R=titzer@chromium.org Bug: v8:8423 Change-Id: Ide8533b154daa227e044820bb9c181f836ba654a Reviewed-on: https://chromium-review.googlesource.com/c/1370028 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by: -
Clemens Hammacher authored
This loop is redundant in {GetNodes}. R=titzer@chromium.org Bug: v8:8423 Change-Id: Ia624fbe145ae2cd77ea099c3f109899ea6fac9c0 Reviewed-on: https://chromium-review.googlesource.com/c/1370031Reviewed-by: -
Igor Sheludko authored
and a bit of drive-by cleanup. Bug: v8:8518 Change-Id: I46873f0a5e56509d75f2d169dc7a4372cc94efbc Reviewed-on: https://chromium-review.googlesource.com/c/1370027Reviewed-by:
-
Clemens Hammacher authored
Instead of branching to the end merge of the outermost block, we should return directly. This often generates shorter and faster code, since the merge is omitted. R=titzer@chromium.org Bug: v8:6600, v8:8423 Change-Id: Id5e92b05d3fbbcdb69e4a8bf48629d6031d85291 Reviewed-on: https://chromium-review.googlesource.com/c/1358411Reviewed-by:
-
Clemens Hammacher authored
Names of external references are statically known, so there is no need to store them in the dynamically generated ExternalReferenceTable. This saves 7.4kB per Isolate, plus ~46.4kB binary size. R=mstarzinger@chromium.org Bug: v8:8562 Change-Id: Ia494de38474e0a7308563ab6d1797ff488b0a072 Reviewed-on: https://chromium-review.googlesource.com/c/1369947Reviewed-by:
-
Andreas Haas authored
When the --debug-code flag is turned on, we create code now which checks if the thread-in-wasm flag has the expected value. If not, we abort execution. R=clemensh@chromium.org Bug: v8:5277, v8:8554 Change-Id: I74c4e6a60b874b48f13ded9b5cee81f602e4c9fd Reviewed-on: https://chromium-review.googlesource.com/c/1370025Reviewed-by:
-
Dan Elphick authored
Bug: chromium:911416 Change-Id: I04d3faa5ee042c99a400294e2a6dbed99c8d7020 Reviewed-on: https://chromium-review.googlesource.com/c/1366616 Commit-Queue: Dan Elphick <delphick@chromium.org> Reviewed-by:
-
Predrag Rudic authored
MIPS32 doesn't have instructions to properly handle 64-bit atomic instructions. Skipping those test on MIPS64 simulator because they have flaky TIMEOUT on buildbots. Change-Id: I31511dfce70a933b9326a7c270509c5f31af743a Reviewed-on: https://chromium-review.googlesource.com/c/1367450Reviewed-by:
-
Leszek Swirski authored
This reverts commit 92db073f. Reason for revert: Breaks devtools test https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8-Blink%20Win/15539 Devtools seems to parse our error messages, e.g. https://cs.chromium.org/chromium/src/third_party/blink/renderer/devtools/front_end/object_ui/JavaScriptAutocomplete.js?type=cs&q=isExpressionComplete+javascriptautocomplete&sq=package:chromium&g=0&l=612 Original change's description: > [parser] Improve error message for unclosed function bodies > > This patch changes the output from: > > function fn() { > ^ > SyntaxError: Unexpected end of input > > to: > > function fn() { > ^ > SyntaxError: missing '}' after function body > > Bug: v8:6513, v8:7321 > Change-Id: I4ca8a40fa0be246da2a3ff776b3fb3c87b4ba4e0 > Also-By: gsathya@chromium.org > Reviewed-on: https://chromium-review.googlesource.com/c/1367448 > Commit-Queue: Mathias Bynens <mathias@chromium.org> > Reviewed-by: Marja Hölttä <marja@chromium.org> > Cr-Commit-Position: refs/heads/master@{#58116} TBR=marja@chromium.org,gsathya@chromium.org,mathias@chromium.org Change-Id: Ia2ac413d67fda39eda903c056002ae632df73df9 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:6513, v8:7321 Reviewed-on: https://chromium-review.googlesource.com/c/1370026Reviewed-by:
-
Igor Sheludko authored
which used to treat off-heap slots as on-heap ones and implement embedded objects visitation in derived visitor classes. Bug: v8:8518 Change-Id: Ia40d8135078379cca990e9167d3f1bebb3b5be0a Reviewed-on: https://chromium-review.googlesource.com/c/1367747Reviewed-by:
-
