- 21 Sep, 2018 15 commits
-
-
Jakob Gruber authored
Bug: v8:6666 Change-Id: I3867339640de252884b7941abdacff0872eaff39 Reviewed-on: https://chromium-review.googlesource.com/1235916 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#56120}
-
Dan Elphick authored
Change the following functions from V8_DEPRECATE_SOON to V8_DEPRECATED: JSON::Parse ValueSerializer::ReleaseBuffer,TransferSharedArrayBuffer Date::New ResourceConstraints::max_semi_space_size, set_max_semi_spaceisize, max_executable_size, set_max_executable_size Bug: v8:8015, v8:7269 Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng Change-Id: I2724738809fe1db28dbe279d476ac6fdf72ee5fa Reviewed-on: https://chromium-review.googlesource.com/1235915Reviewed-by:
Yang Guo <yangguo@chromium.org> Commit-Queue: Dan Elphick <delphick@chromium.org> Cr-Commit-Position: refs/heads/master@{#56119}
-
Simon Zünd authored
R=jgruber@chromium.org Bug: v8:6666 Change-Id: I3ece4039297f837a3677c62c4a76433b73ebbe15 Reviewed-on: https://chromium-review.googlesource.com/1233916Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Commit-Queue: Simon Zünd <szuend@google.com> Cr-Commit-Position: refs/heads/master@{#56118}
-
Jakob Gruber authored
Handlers were recently moved to the builtins table, and we never added full support for this flag. It doesn't add much value and lazy deserialization is scheduled for mid-term removal anyways, so let's just delete it. --lazy-deserialization now controls both builtin- and handler-deserialization behavior. Bug: v8:6624 Change-Id: Iffb7286a00157966abf99158ba629ce4765536d6 Reviewed-on: https://chromium-review.googlesource.com/1238235 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Dan Elphick <delphick@chromium.org> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#56117}
-
Sigurd Schneider authored
Change-Id: I9eda6409d05c59085a09ebc7079b9c12c9877574 Bug: v8:6666 Reviewed-on: https://chromium-review.googlesource.com/1236577 Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Reviewed-by:
-
Benedikt Meurer authored
Improve the lowering of CheckedInt32Div and CheckedUint32Div for the case that the right hand side is a known (positive) power of two, as in that case it's sufficient to just check the relevant bits on the left hand side and then shift by the appropriate amount of bits. This is significantly faster than what TurboFan is able to generate from the general lowering, even with all the MachineOperatorReducer magic (it even shows as a steady ~1.5% overall improvement on the Kraken crypto ccm benchmark). Also turn the general CheckedInt32Div lowering into readable code again, and make sure that all the bailout cases are properly covered by mjsunit tests (i.e. the "division by zero" bailout was not covered properly). Bug: v8:8015 Change-Id: Ibfdd367a6ee5d70dcaa48801858042c5029b7004 Reviewed-on: https://chromium-review.googlesource.com/1236954Reviewed-by:
-
Benedikt Meurer authored
The previous tests didn't cover the case Number.isSafeInteger(x) where TurboFan was unable to tell that `x` is always a Number and thus had to use the ObjectIsSafeInteger operator instead. Bug: v8:8015 Change-Id: I9bdbfa602fe0bf8c5fb2bc6c160ace7ab0bc0aaa Reviewed-on: https://chromium-review.googlesource.com/1238234Reviewed-by:
-
Benedikt Meurer authored
Again in the spirit of https://chromium-review.googlesource.com/1226033 we can simplify the handling of NumberDivide and decide the lowering based on the feedback type. Drive-by-fix: Add test coverage for the relevant corner cases of the NumberDivide handling in SimplifiedLowering. Bug: v8:8015 Change-Id: I0edaca0fddb31d64d2c269268e87a32a687a0b26 Reviewed-on: https://chromium-review.googlesource.com/1236262Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#56113}
-
Benedikt Meurer authored
The ObjectIsArrayBuffer simplified operator, which is used to implement the ArrayBuffer.isView() builtin, didn't have any test coverage. Bug: v8:8015 Change-Id: Ia15e35bc4ae61627137f7a89976560a8d3db771f Reviewed-on: https://chromium-review.googlesource.com/1238215Reviewed-by:
-
Sigurd Schneider authored
This CL changes Construct, ConstructVarargs, ConstructForwardVarargs and ConstructFunctionForwardVarargs to preserve the kRootRegister (ebx). Bug: v8:6666 Change-Id: Ia2c328e419506c029cda76fc210bbd45d9eb5952 Reviewed-on: https://chromium-review.googlesource.com/1233654Reviewed-by:
-
Jakob Gruber authored
Even in the embedded bytecode handler configuration, there's currently no guarantee that all handlers are eager. Specifically, on ia32 handlers are currently not embedded and thus lazy. We need to keep lazy deserialization logic around until that is no longer the case. Bug: v8:6624 Change-Id: Ie4ec5f0fcd9890ed96a5df3bf3654e85379f92ae Reviewed-on: https://chromium-review.googlesource.com/1236261Reviewed-by:
-
Florian Sattler authored
Fixing clang-tidy warning. Bug: v8:8015 Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng Change-Id: I722e15193b3b269e94dc8e5aba80f6f73c95cda8 Reviewed-on: https://chromium-review.googlesource.com/1228036 Commit-Queue: Florian Sattler <sattlerf@google.com> Reviewed-by:
Adam Klein <adamk@chromium.org> Reviewed-by:
Sathya Gunasekaran <gsathya@chromium.org> Cr-Commit-Position: refs/heads/master@{#56109}
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/64006c6..641370b Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/582a06e..6f7c60d Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/f837545..92df4e6 Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/35ffce8..9ad74fa TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org Change-Id: Ifd02fa9d9b285854849b89aabea890e4c0124303 Reviewed-on: https://chromium-review.googlesource.com/1237853 Commit-Queue: V8 Autoroller <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Reviewed-by:
V8 Autoroller <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#56108}
-
Sam Clegg authored
Without this the call to `formatFailureText` in `test-async.js` fails but goes unnoticed since the promise change is rejects which is not handled. And d8 silently ignores the the unhandled rejections. Once `formatFailureText` was added it reveals a but where several tests were expecting `.equal` to be a deepEquals. Specifically: test/mjsunit/es6/promise-all.js test/mjsunit/harmony/async-generators-resume-return.js test/mjsunit/harmony/async-generators-return.js test/mjsunit/harmony/async-generators-yield.js Making equals call `deepEquals` fixed that issue. Change-Id: I350c7d916147eaa7cf873bdaf273aebbaaa833c5 Reviewed-on: https://chromium-review.googlesource.com/1236852 Commit-Queue: Sam Clegg <sbc@chromium.org> Reviewed-by:
-
Jakob Kummerow authored
GCC 7.x doesn't like it (-Werror=subobject-linkage) when a class either derives from a class or has a member field of a type that was declared in an anonymous namespace. It is also opposed (-Werror=attributes) to visibility attributes being defined at explicit template instantiations. GCC 8.x further has reservations (-Werror=class-memaccess) about letting memset/memcpy modify areas within non-POD objects. Change-Id: Ic5107bb5ee3af6233e3741e3ef78d03a0a84005a Reviewed-on: https://chromium-review.googlesource.com/1208306 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
Ben Titzer <titzer@chromium.org> Cr-Commit-Position: refs/heads/master@{#56106}
-
- 20 Sep, 2018 25 commits
-
-
Sathya Gunasekaran authored
Previously, Atomics.notify was just an alias to Atomics.wake, which doesn't quite let us add a use counter for these individual builtins. This patch refactors the existing Atomics.wake into a separate function that is called from two separate builtins. Bug: v8:7883 Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng Change-Id: If54c8f769b7949d88d327cfb2f70db394f32a0b7 Reviewed-on: https://chromium-review.googlesource.com/1234581 Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org> Reviewed-by:
Ben Smith <binji@chromium.org> Cr-Commit-Position: refs/heads/master@{#56105}
-
Junliang Yan authored
R=joransiu@ca.ibm.com Change-Id: Ibebb8bdb064628443c7bb4093382c3e7e8c04472 Reviewed-on: https://chromium-review.googlesource.com/1236601Reviewed-by:
Muntasir Mallick <mmallick@ca.ibm.com> Commit-Queue: Junliang Yan <jyan@ca.ibm.com> Cr-Commit-Position: refs/heads/master@{#56104}
-
Junliang Yan authored
R=joransiu@ca.ibm.com Change-Id: Iace9b8bf40d416b2c7c56c383d00b4f0a6501de1 Reviewed-on: https://chromium-review.googlesource.com/1236973Reviewed-by:
-
Michael Lippautz authored
Bug: chromium:843903 Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng Change-Id: I93fffd197d1742d0b00e69e0967a9efb47921208 Reviewed-on: https://chromium-review.googlesource.com/1236253Reviewed-by:
Hannes Payer <hpayer@chromium.org> Reviewed-by:
-
Hai Dang authored
This CL extracts the branch into a new function. Previously, the branch is only used to copy a FixedArray to a new FixedArray. The new function generalizes this to allow copying from a FixedDoubleArray to a FixedArray also. This function will be useful in a follow-up CL to copy a FixedDoubleArray with holes into a FixedArray where holes are replaced by undefined. Bug: chromium:881273, v8:7980 Change-Id: I8a0e5f933fc152a12d67810f4cbcfdce094d44af Reviewed-on: https://chromium-review.googlesource.com/1230913 Commit-Queue: Hai Dang <dhai@google.com> Reviewed-by:
Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#56101}
-
Toon Verwaest authored
Change-Id: Idb0aa9a7ad246def358beae0b2b464496223d749 Reviewed-on: https://chromium-review.googlesource.com/1236575Reviewed-by:
Igor Sheludko <ishell@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#56100}
-
Ross McIlroy authored
Merge UnoptimizedCompileJobTest::CompileFailureToFinalize and UnoptimizedCompileJobTest::CompileFailureToAnalyse They both do the same thing, and UnoptimizedCompileJobTest.CompileFailureToFinalize was failing on arm due to stack size parameters. BUG=v8:8041 No-Presubmit: true No-Tree-Checks: true No-Try: true Change-Id: I2506aed026420c2634d5cd41b0dc268debb512eb Reviewed-on: https://chromium-review.googlesource.com/1236814Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/master@{#56099}
-
Toon Verwaest authored
Change-Id: I985ba650bb6623bcd399926ac2254dd7f5d3bee6 Reviewed-on: https://chromium-review.googlesource.com/1235925 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Reviewed-by:
-
Sreten Kovacevic authored
Port fef047a4 Original commit message: `This CL implements the following design doc: https://docs.google.com/document/d/1h5kdfemMQMpUd15PSKW1lqikJW5hsGwrmOvoqhGFRts/edit?ts=5b978756#heading=h.urs7r34mx9p ` Change-Id: Ib34a2e18c56bc7ccf3cbfa0f1baa07dcc8ed0cd4 Reviewed-on: https://chromium-review.googlesource.com/1235974Reviewed-by:
-
Sigurd Schneider authored
R=jgruber@chromium.org Bug: v8:6666, v8:8015 Change-Id: I37c4fc6771247c448ec3194790fe9fad3c9bdebf Reviewed-on: https://chromium-review.googlesource.com/1236054 Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Reviewed-by:
-
Alexey Kozyatinskiy authored
This property might be useful for fast '===' check. R=dgozman@chromium.org,yangguo@chromium.org Bug: none Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel;luci.chromium.try:linux_chromium_rel_ng;master.tryserver.blink:linux_trusty_blink_rel Change-Id: Iabc3555ce1ec2c14cf0ccd40b7d964ae144e7352 Reviewed-on: https://chromium-review.googlesource.com/1226411Reviewed-by:
Dmitry Gozman <dgozman@chromium.org> Reviewed-by:
-
Benedikt Meurer authored
In the spirit of https://chromium-review.googlesource.com/1226033 we can also unify the handling of NumberModulus based on feedback types. Drive-by-fix: Add appropriate tests for the corner cases of the NumberModules with (surrounding) feedback integration. Bug: v8:8015 Change-Id: I5e3207d2f6e72f9ea1d7658014b7272075088d63 Reviewed-on: https://chromium-review.googlesource.com/1236260 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
-
Benedikt Meurer authored
The coverage bot figured out that there's missing test coverage for the SpeculativeNumberModulus corner cases inside of the SimplifiedLowering logic. Bug: v8:8015 Change-Id: Id32aa545dc43adae5e67c66574ccea5f2b3db846 Reviewed-on: https://chromium-review.googlesource.com/1236259 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
-
Michael Lippautz authored
Adds support for tracing wrappers of the following types: - JSArrayBuffer - JSDataView - JSTypedArray Unlike API objects, these objects are equipped with embedder fields at compile time and can thus be attached to Blink objects at any time. Bug: chromium:885125, chromium:843903 Change-Id: If2dab4831f42a4edc0748b7071d451fe1953f076 Reviewed-on: https://chromium-review.googlesource.com/1234418Reviewed-by:
-
Yang Guo authored
R=bmeurer@chromium.org Bug: chromium:680662 Change-Id: I8dace89d576dfcc5833fd539ce698a9ade1cb5a0 Reviewed-on: https://chromium-review.googlesource.com/1235928 Commit-Queue: Yang Guo <yangguo@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#56091}
-
Benedikt Meurer authored
This adds missing test coverage for corner cases of SpeculativeNumberAdd and SpeculativeNumberSubtract inside of SimplifiedLowering. This was discovered to be untested by the coverage bot. Bug: v8:8015 Change-Id: I7355b1b840a76bc12bd911adb6c2d88f05d816c5 Reviewed-on: https://chromium-review.googlesource.com/1236256Reviewed-by:
-
Georg Neis authored
Bug: v8:7790 Change-Id: Ie8b4c84188a123ddec99c65146ddd7c70e1f1b05 Reviewed-on: https://chromium-review.googlesource.com/1236073 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/master@{#56089}
-
Ross McIlroy authored
Refactors the CompilerDispatcher to be able to enqueue eager inner functions for off-thread compilation during top-level compilation of a script. Unoptimized compile jobs are simplified to only have two phases - compile and finalization. Only finalization requires heap access (and therefore needs to be run on the main thread). The change also introduces a requirement to register a SFI with a given compile job after that job is posted, this is due to the fact that an SFI won't necessarily exist at the point the job is posted, but is created later when top-level compile is being finalized. Logic in the compile dispatcher is update to deal with the fact that a job may not be able to progress if it doesn't yet have an associated SFI registered with it. BUG=v8:8041 Change-Id: I66cccd626136738304a7cab0e501fc65cf342514 Reviewed-on: https://chromium-review.googlesource.com/1215782 Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
Marja Hölttä <marja@chromium.org> Reviewed-by:
-
Benedikt Meurer authored
Part of https://chromium-review.googlesource.com/1231994 that landed earlier, but was reverted due to breakage. Landing this cleanup separately instead. Drive-by-fix: Also add test coverage for the cases that weren't covered properly (according to the test coverage bot). Bug: chromium:225811, v8:8015 Change-Id: I9c13ed5fcf0ba9e6b190489e15df86970eafdc13 Reviewed-on: https://chromium-review.googlesource.com/1236213Reviewed-by:
-
Jakob Gruber authored
Drive-by: Clarify code that initializes the allocation site argument of ArrayNArgumentsConstructor to undefined. Until now, this was done in InternalArrayConstructor prior to calling the Impl builtin. But the allocation site is not part of the Impl interface descriptor and worked only by chance since we did not clobber the register. Also, the argument is only needed for the path that calls ArrayNArgumentsConstructor and can be omitted elsewhere. This CL pulls initialization to just before the final call. Bug: v8:6666 Change-Id: I24471ca0291a83dfad7af4cc11d699c8923117ec Reviewed-on: https://chromium-review.googlesource.com/1235917 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
-
Simon Zünd authored
R=jgruber@chromium.org Bug: v8:6666 Change-Id: Icdf9ab0770cc4d6dd1c7c3a3911ffcc7a493d127 Reviewed-on: https://chromium-review.googlesource.com/1233915 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
-
Clemens Hammacher authored
The n5x bot fails to *allocate* more memory just before we reach the soft limit of 512 GiB for *reserved* memory. Thus reduce it a bit. This still leaves enough room for ~38 wasm memories with full guard regions. R=ahaas@chromium.org Bug: v8:8196 Change-Id: I6049e2baa3fc8b99c9269f8cb7c013a6e77ebf9b Reviewed-on: https://chromium-review.googlesource.com/1235924Reviewed-by:
Andreas Haas <ahaas@chromium.org> Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#56084}
-
Mathias Bynens authored
Port the remaining tests from: https://chromium-review.googlesource.com/c/v8/v8/+/1227974/1/test/mjsunit/harmony/regexp-property-emoji-flag-sequence-generated.js#9 Bug: v8:7467 Change-Id: Ib187c93cb38befbbba31bdf93a0f5d8f1bee3d13 Reviewed-on: https://chromium-review.googlesource.com/1230098Reviewed-by:
Mathias Bynens <mathias@chromium.org> Reviewed-by:
-
Sigurd Schneider authored
This CL ensures that the following builtins preserve the kRootRegister (ebx): InterpreterPushUndefinedAndArgsThenCall InterpreterPushArgsThenCallWithFinalSpread InterpreterPushArgsThenConstruct InterpreterPushArgsThenConstructArrayFunction InterpreterPushZeroAndArgsAndReturnAddress InterpreterPushArgsThenConstructWithFinalSpread Bug: v8:6666 Change-Id: I026654b981276c7d435c18c9eedef3f5d33b6533 Reviewed-on: https://chromium-review.googlesource.com/1233754Reviewed-by:
-
Jakob Gruber authored
FrameDropperTrampoline HandleDebuggerStatement InstantiateAsmJs NotifyDeoptimized Bug: v8:6666 Change-Id: I4189e5dcf82eddd1dbce43b10b04c8e6a980123c Reviewed-on: https://chromium-review.googlesource.com/1235922Reviewed-by:
-
