- 30 Nov, 2018 1 commit
-
-
Peter Marshall authored
This reverts commit 4e3a17d0. Reason for revert: Web compact issues, see crbug.com/910252 Original change's description: > [runtime] Reduce spread/apply call max arguments > > Bug: chromium:906043 > Change-Id: I308b29af0644c318d73926b27e65a94913c760c7 > Reviewed-on: https://chromium-review.googlesource.com/c/1346115 > Commit-Queue: Peter Marshall <petermarshall@chromium.org> > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> > Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > Cr-Commit-Position: refs/heads/master@{#57731} TBR=jarin@chromium.org,jgruber@chromium.org,petermarshall@chromium.org,bmeurer@chromium.org # Not skipping CQ checks because original CL landed > 1 day ago. Bug: chromium:906043 Change-Id: I240c1b55c10fd3e108e3c49f93ce1d9ca9c61780 Reviewed-on: https://chromium-review.googlesource.com/c/1356502Reviewed-by: Peter Marshall <petermarshall@chromium.org> Commit-Queue: Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#57956}
-
- 26 Nov, 2018 1 commit
-
-
Marja Hölttä authored
- Remove heap-inl.h includes from places where it looked unnecessary. (This is a non-scientific approach, because it's probably pulled in indirectly anyway.) - Annotate places which include heap-inl.h because they need heap/ internals. - ACCESSORS legitimately needs heap-inl.h because of Heap::FromWritableHeapObject. - Add includes to heap/heap-write-barrier(-inl).h - A bunch of IWYU fixes discovered when working on this CL (includes which were missing because heap-inl.h pulls them in indirectly). BUG=v8:7490,v8:8238,v8:8499 Change-Id: I00f9a74d430f13d7c080dca77a92b03bcca7ef96 Reviewed-on: https://chromium-review.googlesource.com/c/1349241Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Sigurd Schneider <sigurds@chromium.org> Reviewed-by: Yang Guo <yangguo@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/master@{#57814}
-
- 22 Nov, 2018 1 commit
-
-
Peter Marshall authored
Bug: chromium:906043 Change-Id: I308b29af0644c318d73926b27e65a94913c760c7 Reviewed-on: https://chromium-review.googlesource.com/c/1346115 Commit-Queue: Peter Marshall <petermarshall@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#57731}
-
- 22 Oct, 2018 1 commit
-
-
Jakob Gruber authored
This removes a bunch of porting helpers, e.g. scopes that mark the addressability of ebx, printing embedded builtin candidates, and the call/jump mechanism through a virtual target register. This also disables root register verification by default on ia32. It can be completely removed in a bit. Bug: v8:6666 Change-Id: I4705d61991ddc57c30981c311a1c8c5e2f8ddf4d Reviewed-on: https://chromium-review.googlesource.com/c/1288271Reviewed-by: Sigurd Schneider <sigurds@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#56864}
-
- 15 Oct, 2018 1 commit
-
-
Hai Dang authored
This removes the check for holeyness when using CopyFixedArrayElements, because the function does not use that information. Change-Id: I6033495bf00947ded083ebc24695f6c8bf4569d0 Reviewed-on: https://chromium-review.googlesource.com/c/1280763 Commit-Queue: Hai Dang <dhai@google.com> Reviewed-by: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#56646}
-
- 28 Sep, 2018 1 commit
-
-
Daniel Clifford authored
This CL adds a bit more rigor to the handling of length properties in JSObject-derived classes that explicitly contain that property inline. This involves: - Introducing a new superclass of JSArgumentsObject called JSArgumentsObjectWithLength that is shared with other object instances that also have a fixed length property. - Adding JSArgumentsObjectWithLength to the type hierarchy in Torque, including adding fast-cases for leading the length property for all classes deriving from JSObjectWithLength. - Adding more rigor to Context and NativeContext handling in base.tq. This is useful for the map checks required to verify objects are argument object types derived from JSArgumentsObjectWithLength. Change-Id: I2f0a20601ffcb90b3767cbaeb766e9998d3462ec Reviewed-on: https://chromium-review.googlesource.com/1248661 Commit-Queue: Daniel Clifford <danno@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#56289}
-
- 21 Sep, 2018 1 commit
-
-
Sigurd Schneider authored
This CL changes Construct, ConstructVarargs, ConstructForwardVarargs and ConstructFunctionForwardVarargs to preserve the kRootRegister (ebx). Bug: v8:6666 Change-Id: Ia2c328e419506c029cda76fc210bbd45d9eb5952 Reviewed-on: https://chromium-review.googlesource.com/1233654Reviewed-by: Jakob Gruber <jgruber@chromium.org> Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#56111}
-
- 20 Sep, 2018 3 commits
-
-
Sigurd Schneider authored
Bug: v8:6666 Change-Id: I5c75eda044312bba6be1ce6bf71afbfe94534afc Reviewed-on: https://chromium-review.googlesource.com/1233674Reviewed-by: Jakob Gruber <jgruber@chromium.org> Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#56075}
-
Sigurd Schneider authored
This CL ensures the kRootRegister (ebx) is preserved in Call_ReceiverIsNullOrUndefined Call_ReceiverIsNotNullOrUndefined Call_ReceiverIsAny Bug: v8:6666 Change-Id: Ifef8ba544110c45810a8f895869acdd5b61d1d5d Reviewed-on: https://chromium-review.googlesource.com/1233597Reviewed-by: Jakob Gruber <jgruber@chromium.org> Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#56071}
-
Igor Sheludko authored
and introduce RootsTable - a V8 heap roots storage. So, the renaming part looks like this: Heap::RootListIndex -> RootIndex Heap::kBlahBlahRootIndex -> RootIndex::kBlahBlah Bug: v8:8015, v8:8182 Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng Change-Id: I38e1f3e3f6813ef35e37b0bed35e9ae14a62134f Reviewed-on: https://chromium-review.googlesource.com/1234613Reviewed-by: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Hannes Payer <hpayer@chromium.org> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#56067}
-
- 19 Sep, 2018 1 commit
-
-
Jakob Gruber authored
As part of this, we also update all InvokeFunctionCode callers to pass ecx as the expected-argc register. Drive-by: Inline InvokeFunction overload into its single use. Bug: v8:6666 Change-Id: I67590ecc3f4981d014642c9e18d3ed6db9831e54 Reviewed-on: https://chromium-review.googlesource.com/1233653 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#56040}
-
- 14 Sep, 2018 1 commit
-
-
Jakob Gruber authored
This reverts commit 99e13e58. Reason for revert: Reverting in favor of a general mechanism for this in Torque. Original change's description: > [builtins] Add FastCallFunction builtin that elides some checks > > This CL adds a new "Call" stub that can be used by builtins that will > call the same JS call-back function often (e.g. compare function in > Array.p.sort). The checks have to be done upfront once, but can then > be omitted. > > R=jgruber@chromium.org > > Bug: v8:7861 > Change-Id: Id6e4ca27c3d488a7b1f708cbcb4cbe6cc382513e > Reviewed-on: https://chromium-review.googlesource.com/1208574 > Commit-Queue: Simon Zünd <szuend@google.com> > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > Reviewed-by: Camillo Bruni <cbruni@chromium.org> > Cr-Commit-Position: refs/heads/master@{#55769} TBR=cbruni@chromium.org,jgruber@chromium.org,szuend@google.com # Not skipping CQ checks because original CL landed > 1 day ago. Bug: v8:7861 Change-Id: I47260993ef2a16bd5348bb0b46da4d34d33ea10b Reviewed-on: https://chromium-review.googlesource.com/1226871 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/master@{#55897}
-
- 11 Sep, 2018 1 commit
-
-
Simon Zünd authored
This CL adds a new "Call" stub that can be used by builtins that will call the same JS call-back function often (e.g. compare function in Array.p.sort). The checks have to be done upfront once, but can then be omitted. R=jgruber@chromium.org Bug: v8:7861 Change-Id: Id6e4ca27c3d488a7b1f708cbcb4cbe6cc382513e Reviewed-on: https://chromium-review.googlesource.com/1208574 Commit-Queue: Simon Zünd <szuend@google.com> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/master@{#55769}
-
- 05 Sep, 2018 1 commit
-
-
Hai Dang authored
This is a reland of 1c48d52b. It turned out that IterableToList doesn't always behave according to the ES operation with the same name. Specifically, it allows holey arrays to take its fast path, which produces an output array with holes where actually "undefined" elements should appear. This CL changes the version of IterableToList that is used for spreads (IterableToListWithSymbolLookup) such that holey arrays take the slow path. It also includes tests for such situations. Original change's description: > [interpreter] Add bytecode for leading array spreads. > > This CL improves the performance of creating [...a, b] or [...a]. > If the array literal has a leading spread, this CL emits the bytecode > [CreateArrayFromIterable] to create the literal. CreateArrayFromIterable > is implemented by [IterableToListDefault] builtin to create the initial > array for the leading spread. IterableToListDefault has a fast path to > clone efficiently if the spread is an actual array. > > The bytecode generated is now shorter. Bytecode generation is refactored > into to BuildCreateArrayLiteral, which allows VisitCallSuper to benefit > from this optimization also. > For now, turbofan also lowers the bytecode to the builtin. > > The idiomatic use of [...a] to clone the array a now performs better > than a simple for-loop, but still does not match the performance of slice. > > Bug: v8:7980 > > Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng > Change-Id: Ibde659c82d3c7aa1b1777a3d2f6426ac8cc15e35 > Reviewed-on: https://chromium-review.googlesource.com/1181024 > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> > Reviewed-by: Sigurd Schneider <sigurds@chromium.org> > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > Reviewed-by: Georg Neis <neis@chromium.org> > Commit-Queue: Georg Neis <neis@chromium.org> > Commit-Queue: Hai Dang <dhai@google.com> > Cr-Commit-Position: refs/heads/master@{#55520} Bug: v8:7980 Change-Id: I0b5603a12d2b588327658bf0a9b214bd0f22e237 Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng Reviewed-on: https://chromium-review.googlesource.com/1201882 Commit-Queue: Hai Dang <dhai@google.com> Reviewed-by: Georg Neis <neis@chromium.org> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#55639}
-
- 28 Aug, 2018 1 commit
-
-
jgruber authored
These two builtins are a special case in that their calling convention must be kept in-sync since they are both generated from Generate_CallOrConstructVarargs. ConstructVarargs in particular used all available registers. In order to free ebx, the calling convention is changed to pass the last argument on the stack. As part of this change, the order of the last two arguments is swapped since the stack parameter must be tagged. Bug: v8:6666 Change-Id: If1ad14fc09693c36dd63ffebb6f34fcd3f012896 Reviewed-on: https://chromium-review.googlesource.com/1193444Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Sigurd Schneider <sigurds@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#55458}
-
- 17 Aug, 2018 1 commit
-
-
Kanghua Yu authored
This CL refactors the CodeAssembler::Branch(condition, true_body, false_body) which was introduced by https://crrev.com/c/1175488, and this reduces snapshot by 864 bytes. Change-Id: Ifde7d6f39bd7f265e71fef5bdcc6e69d8ab5be85 Reviewed-on: https://chromium-review.googlesource.com/1175488Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Kanghua Yu <kanghua.yu@intel.com> Cr-Commit-Position: refs/heads/master@{#55179}
-
- 13 Aug, 2018 1 commit
-
-
Tobias Tebbi authored
drive-by change: fix wrong typing in CSA. Change-Id: I9234306e8568a64157b44a86a58f09e65116b298 Reviewed-on: https://chromium-review.googlesource.com/1172583 Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#55093}
-
- 09 Aug, 2018 1 commit
-
-
Kanghua Yu authored
Benefit from constant folding, this CL reduce snapshot by 704 bytes for {Call,Construct}WithArrayLike builtins. R=tebbi@chromium.org Change-Id: I34f055c9b46039698150f560644459aa492cde9e Reviewed-on: https://chromium-review.googlesource.com/1168739 Commit-Queue: Kanghua Yu <kanghua.yu@intel.com> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#55008}
-
- 25 Jun, 2018 2 commits
-
-
Camillo Bruni authored
Bug: chromium:850005, chromium:852085, Change-Id: I777321306b1b68330e39e43aacc715478764649f Reviewed-on: https://chromium-review.googlesource.com/1104470 Commit-Queue: Camillo Bruni <cbruni@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#54007}
-
Peter Marshall authored
Currently we perform the full iteration protocol even when we don't need to. When IterableToListCanBeElided is true, we still need to create a copy of the array (from a spec correctness point of view, in case there are user-JS side-effects that would modify the original). This CL copies the array directly, skipping the iteration protocol. This recovers the JSTests/TypedArrays/ConstructArrayLike benchmark almost completely. Change-Id: I7f1593dd9af6e4a0485bd654e6c02186c5ae99d0 Reviewed-on: https://chromium-review.googlesource.com/1105995Reviewed-by: Jakob Gruber <jgruber@chromium.org> Commit-Queue: Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#53996}
-
- 19 Jun, 2018 1 commit
-
-
Peter Marshall authored
Bug: chromium:854066 Change-Id: Icabd9bf5e00868822b9debfb9bbb5d3932726465 Reviewed-on: https://chromium-review.googlesource.com/1105774 Commit-Queue: Peter Marshall <petermarshall@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#53840}
-
- 18 Jun, 2018 1 commit
-
-
Igor Sheludko authored
Bug: v8:7754 Change-Id: Ie8224f2cda1132f0ac8f5508b54c31a6164a944e Reviewed-on: https://chromium-review.googlesource.com/1104160Reviewed-by: Jakob Gruber <jgruber@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#53783}
-
- 06 Jun, 2018 1 commit
-
-
Camillo Bruni authored
Bug: chromium:850005 Change-Id: I287a274b86941e7d29705a24e479e4a02ecdfb07 Reviewed-on: https://chromium-review.googlesource.com/1088608Reviewed-by: Jakob Gruber <jgruber@chromium.org> Commit-Queue: Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/master@{#53546}
-
- 01 Jun, 2018 1 commit
-
-
Camillo Bruni authored
Drive-by-fix: - Add CSA::LoadElementsKind helper Bug: v8:7796 Change-Id: Icbf81effdd42efa7f8ec56f8d1a40c331c7a25e4 Reviewed-on: https://chromium-review.googlesource.com/1078849 Commit-Queue: Camillo Bruni <cbruni@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#53472}
-
- 30 May, 2018 1 commit
-
-
Camillo Bruni authored
Type users of AllocateFixedArray with intptr parameters. Bug: v8:7796 Change-Id: I4b155fb3fcb90fe66a3c20a24f0cea678a5d85bc Reviewed-on: https://chromium-review.googlesource.com/1078347 Commit-Queue: Camillo Bruni <cbruni@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#53436}
-
- 13 Mar, 2018 1 commit
-
-
Benedikt Meurer authored
The IterableToList helper builtin can return the input JSArray unchanged if the fast-path detection decides that it doesn't need to iterate the elements, which means we can also get a JSArray with an elements kind that is not PACKED_ELEMENTS as a result of IterableToList. Bug: chromium:821159, v8:7310 Change-Id: I93a886e6b7f1e1a58dd05affa46fea7501cc5a81 Reviewed-on: https://chromium-review.googlesource.com/959323Reviewed-by: Yang Guo <yangguo@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#51893}
-
- 12 Mar, 2018 1 commit
-
-
Benedikt Meurer authored
Use IteratorToList to implement CallWithSpread and ConstructWithSpread instead. Bug: v8:7310 Change-Id: Ic1c44cc97914fa4fb92da8c568ac66f3ae78e520 Reviewed-on: https://chromium-review.googlesource.com/956073Reviewed-by: Peter Marshall <petermarshall@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#51871}
-
- 02 Mar, 2018 1 commit
-
-
Benedikt Meurer authored
Previously the array iterator protector only guarded the lookup of the @@iterator symbol on the initial Array.prototype, and we had to use an additional map check on the %ArrayIteratorPrototype% to ensure that no one messed with the next() method. This CL extends the array iterator protector to also guard the lookup of %ArrayIteratorPrototype%.next. This simplifies the code quite a bit and makes it more robust for cases where someone has to install additional methods on the iterator prototype, i.e. a custom async iterator. Bug: v8:7510, v8:7514 Change-Id: Ie6080bb837a91a2b60b224597121470614210660 Reviewed-on: https://chromium-review.googlesource.com/945728Reviewed-by: Peter Marshall <petermarshall@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#51684}
-
- 23 Feb, 2018 1 commit
-
-
Sigurd Schneider authored
Bug: v8:7310 Change-Id: I3b9832c7090d5c4b2f425f85095b0d7bae29fbfd Reviewed-on: https://chromium-review.googlesource.com/934321 Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#51519}
-
- 18 Jan, 2018 1 commit
-
-
peterwmwong authored
- Add Map, WeakMap, Set, and WeakSet initial prototype maps to native context. - Set and WeakSet constructors check whether prototype map differs from initial before choosing the fast path. Bug: chromium:798026 Change-Id: I5f9cc2463f89e17f06a66b565c625fce133d01fb Reviewed-on: https://chromium-review.googlesource.com/853698 Commit-Queue: Peter Wong <peter.wm.wong@gmail.com> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/master@{#50691}
-
- 20 Nov, 2017 1 commit
-
-
Benedikt Meurer authored
The "array protector" now guards the Object.prototype, the Array.prototype and the String.prototype, so the name was a bit misleading nowadays. So the new name "no elements protector" was chosen. Bug: v8:6936, v8:7014, v8:7027 Change-Id: I9a9d7caa2caf0ac9e78cc6658de2f0506970dfa2 Reviewed-on: https://chromium-review.googlesource.com/778162Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by: Camillo Bruni <cbruni@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#49471}
-
- 20 Oct, 2017 1 commit
-
-
Mike Stanton authored
And less Node *. The creeping introduction of types. Bug: v8:6949 Change-Id: I8a559ef03e14ede8110faa4c456bbb9ce6cf56ca Reviewed-on: https://chromium-review.googlesource.com/730467Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Michael Stanton <mvstanton@chromium.org> Cr-Commit-Position: refs/heads/master@{#48791}
-
- 13 Oct, 2017 1 commit
-
-
Camillo Bruni authored
- LoadJSArrayLength - LoadStringLength - LoadElements - LoadFixedArrayBaseLength Bug: v8:6921 Change-Id: I6bc72e99f4f8c993cb6923f19df1fbaec82881d0 Reviewed-on: https://chromium-review.googlesource.com/718199Reviewed-by: Peter Marshall <petermarshall@chromium.org> Commit-Queue: Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/master@{#48530}
-
- 02 Oct, 2017 1 commit
-
-
Daniel Clifford authored
Change-Id: Iac4a95a0c094472d887d89bbf5d6189988c56f7c Reviewed-on: https://chromium-review.googlesource.com/692016 Commit-Queue: Daniel Clifford <danno@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#48253}
-
- 13 Sep, 2017 1 commit
-
-
Michael Starzinger authored
R=clemensh@chromium.org Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng Change-Id: I3df5d50f81909188ee0cb31d0f479aadeeabe20f Reviewed-on: https://chromium-review.googlesource.com/662780Reviewed-by: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Clemens Hammacher <clemensh@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#47991}
-
- 07 Aug, 2017 1 commit
-
-
Benedikt Meurer authored
The ConstructFunctionForwardVarargs and ConstructForwardVarargs builtins, which are used when inlining the Reflect.construct builtin into TurboFan optimized code, didn't properly check the new.target parameter whether it's a constructor. Bug: chromium:752481 Change-Id: I9b8f8c429d6eaed0ff8d27fc3f6b52eb906766a2 Reviewed-on: https://chromium-review.googlesource.com/604187 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#47206}
-
- 13 Jul, 2017 1 commit
-
-
Adam Klein authored
The tail call implementation is hidden behind the --harmony-tailcalls flag, which is off-by-default (and has been unstaged since February). It is known to be broken in a variety of cases, including clusterfuzz security issues (see sample Chromium issues below). To avoid letting the implementation bitrot further on trunk, this patch removes it. Bug: v8:4698, chromium:636914, chromium:724746 Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng;master.tryserver.v8:v8_linux_noi18n_rel_ng Change-Id: I9cb547101456a582374fdf7b1a3f044a9ef33e5c Reviewed-on: https://chromium-review.googlesource.com/569069 Commit-Queue: Adam Klein <adamk@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#46651}
-
- 10 Jul, 2017 1 commit
-
-
Camillo Bruni authored
Change-Id: Iedd1ce0d790c0c1fd69b92657d6a9866f346cedd Reviewed-on: https://chromium-review.googlesource.com/565563Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> Commit-Queue: Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/master@{#46528}
-
- 30 Jun, 2017 1 commit
-
-
Mathias Bynens authored
The `FAST_` prefix doesn’t make much sense — they’re all just different cases with their own optimizations. Packedness being implicit (e.g. `FAST_ELEMENTS` vs. `FAST_HOLEY_ELEMENTS`) is not ideal, either. This patch renames the FAST elements kinds as follows: - e.g. FAST_ELEMENTS => PACKED_ELEMENTS - e.g. FAST_HOLEY_ELEMENTS => HOLEY_ELEMENTS The following exceptions are left intact, for lack of a better name: - FAST_SLOPPY_ARGUMENTS_ELEMENTS - SLOW_SLOPPY_ARGUMENTS_ELEMENTS - FAST_STRING_WRAPPER_ELEMENTS - SLOW_STRING_WRAPPER_ELEMENTS This makes it easier to reason about elements kinds, and less confusing to explain how they’re used. R=jkummerow@chromium.org, cbruni@chromium.org BUG=v8:6548 Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng Change-Id: Ie7c6bee85583c3d84b730f7aebbd70c1efa38af9 Reviewed-on: https://chromium-review.googlesource.com/556032Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Camillo Bruni <cbruni@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by: Andreas Haas <ahaas@chromium.org> Commit-Queue: Mathias Bynens <mathias@chromium.org> Cr-Commit-Position: refs/heads/master@{#46361}
-
- 21 Jun, 2017 1 commit
-
-
bmeurer authored
Add a new JSConstructWithArrayLike operator that is backed by the ConstructWithArrayLike builtin (similar to what was done before for the JSCallWithArrayLike operator), and use that operator to optimize Reflect.construct inlining in TurboFan. This is handled uniformly with JSConstructWithSpread in the JSCallReducer. Also add missing test coverage for Reflect.construct in optimized code, especially for some interesting corner cases. R=petermarshall@chromium.org BUG=v8:4587,v8:5269 Review-Url: https://codereview.chromium.org/2949813002 Cr-Commit-Position: refs/heads/master@{#46087}
-